Connect carefully. Verify explicitly.

Synaura exposes an MCP endpoint for selected design partners. It can evaluate graph-grounded organizational context, but it is not yet a production-grade authorization or proof boundary.

Current status: use only with test or non-sensitive organizational data. Public receipt verification is being repaired, and organization tokens do not yet provide per-tool scopes.

Connection

Access is provisioned per organization. Keep the bearer token server-side and out of prompts, logs, browser storage, and source control.

Endpoint: https://mcp.synaura.ai/YOUR_ORG_ID
Authorization: Bearer YOUR_TOKEN

Client contract

Validate the URL organization against the issued token.
Treat alignment metadata as optional, not universal.
Require human approval for side effects.
Fail closed when evidence or policy fields are absent.

Evidence states

Do not collapse multiple proof stages into a single verified badge.

SignedA retrievable signature validates against the payload and organization key.

Timestamp submittedA request was sent; this is not external attestation.

Calendar attestedA calendar proof is present and independently checkable.

Bitcoin verifiedA transaction and inclusion proof were independently confirmed.

Before production rollout

Scoped credentialsReplace organization-wide bearer authority with tool, resource, role, and environment scopes.

Service identityRemove shared internal-secret bypasses and issue short-lived, audience-bound service assertions.

Deterministic safetyEnforce policy server-side; alignment metadata is context, not authorization.

Complete proof handlingReturn an explicit incomplete state whenever signature, key, payload, attestation, or finality evidence is missing.

Audit and revocationAdd token rotation, immediate revocation, bounded retention, and tenant-visible access logs.

Recommended agent policy

if (!response.authorization_scope) stop("Missing scope");
if (!response.evidence_state) stop("Unknown evidence state");
if (response.side_effect) requireHumanApproval();
if (response.alignment?.trust_status !== "current") requireHumanReview();