The MCP endpoint, in full

One: JSON-RPC 2.0 over a single HTTP request and response, at POST /api/mcp. SSE and streamable-HTTP transport are not shipped, which means no server push, no notifications and no sessions — a client that requires them will not connect.

The key does it. An fr_live_ key resolves to exactly one workspace at the edge, and no tool takes a workspace id in its arguments, so there is nothing in a request body that could point a call at someone else’s data.

Not on a social network. send_reply and publish_content enqueue to the human approval queue and say so in their response — they do not dispatch, for any caller. Email is the one place that is not absolute: send_press_pitch normally queues to the separate press approval queue, but a workspace that has approved fifteen consecutive pitches without editing them earns auto-send, after which it dispatches directly (about one in twenty is still sampled back to a human, and any edit or rejection turns auto-send straight back off) — and from then on it needs a key holding the publish scope. No key can approve a queued item: decide_press_approval only rejects; approving happens in the dashboard.

Two layers. A missing or revoked key fails at the transport layer with HTTP 401. Anything that goes wrong inside the protocol — a malformed body, an unknown method, bad params, an internal error — comes back at HTTP 200 with a JSON-RPC error envelope carrying one of −32700, −32600, −32601, −32602 or −32603. A tool the key’s scopes do not cover returns −32001, and a decision only a human may make (approving, raising autonomy) returns −32002; both carry a data object naming the tool.

Against the routes marked bearer in the API reference, and no others: /api/v1/brain, /api/v1/brain/proposals and the phone-number and verification routes under /api/v1/voice/mcpdial try an fr_live_ bearer first and fall back to the session. Every other /api/v1 route authenticates off the signed-in Supabase cookie and never inspects an Authorization header at all, so a key sent there is not rejected on its merits — it is simply not read, and the request fails as unauthenticated. For anything headless, this endpoint is the surface.

Only a key minted by a workspace owner or admin, and only while that person still is one — the same rule as the Phone numbers page. Keys minted before 4 October 2026 do not record who created them and are refused; mint a new one. buy_phone_number spends credits (the first month at once, then rent monthly) and needs an idempotency_key you reuse on retry; release_phone_number is irreversible and needs confirm: true. A refusal such as insufficient_credits or needs_documents comes back as a result with ok: false and the missing items, so the agent can complete the verification and try again.

A real browser on a session you connected yourself. connect_browser_account mints a one-time connect_url you hand to the user, so nobody ever types a password to the agent, and run_on_page is not a posting path — anything that would post goes through approvals like everything else.