From c02fde270c63180f41618802d7dc172f28b1999c Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 18 Sep 2026 07:21:15 +0000 Subject: [PATCH] docs(deployment): name both Connect-an-Agent doors in the OS_MCP_STDIO_API_KEY row The row told the reader to "Mint one from Setup -> Connect an Agent". SETUP_APP declares requiredPermissions: ['setup.access'], so a permissionless principal gets 403 PERMISSION_DENIED on /api/v1/meta/apps/setup -- a direct minting instruction that names only the Setup door sends a non-admin down a path they cannot take. The page is delivered to them through a navigationContributions entry in the `account` app instead, and the Setup entry stays for admins deliberately. Name both doors, in the wording the sibling pages already use: Account -> Developer for any signed-in user, Setup -> Connect an Agent for platform admins. Compressed to one table cell; pipes and row count unchanged. Claude-Session: https://claude.ai/code/session_017ef78bLdybu3AffehKkhfk Co-authored-by: Claude --- content/docs/deployment/environment-variables.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/docs/deployment/environment-variables.mdx b/content/docs/deployment/environment-variables.mdx index 286193e447d..802124efc20 100644 --- a/content/docs/deployment/environment-variables.mdx +++ b/content/docs/deployment/environment-variables.mdx @@ -257,7 +257,7 @@ OS_MCP_STDIO_ENABLED=true OS_MCP_STDIO_API_KEY=osk_... os start # start the lo |:---|:---|:---|:---| | `OS_MCP_SERVER_ENABLED` | boolean | `true` | The MCP **HTTP** surface (`/api/v1/mcp`) is a core capability and defaults **on**. Set `false` to disable it (endpoint 404s, the Connect-an-Agent page disappears). | | `OS_MCP_STDIO_ENABLED` | boolean | `false` | Auto-start the long-lived **stdio** transport at boot. Opt-in and **stricter** than the HTTP surface. **Requires `OS_MCP_STDIO_API_KEY`** — stdio runs as that key's identity with RLS/FLS/tenant applied; if the key is missing or invalid, boot **fails closed** (stdio refuses to start). See ADR-0101. | -| `OS_MCP_STDIO_API_KEY` | string | — | The `osk_...` API key the **stdio** transport runs as. Resolved through the same verify chain as the HTTP/REST surfaces, so reads are scoped to that identity's permissions. Mint one from **Setup → Connect an Agent** (or `POST /api/v1/keys`). For full authority, mint a key on a platform-admin or dedicated **service** identity — there is deliberately no `system`/unscoped bypass. | +| `OS_MCP_STDIO_API_KEY` | string | — | The `osk_...` API key the **stdio** transport runs as. Resolved through the same verify chain as the HTTP/REST surfaces, so reads are scoped to that identity's permissions. Mint one from the **Connect an Agent** page — **Account → Developer** for any signed-in user, **Setup → Connect an Agent** for platform admins — or `POST /api/v1/keys`. For full authority, mint a key on a platform-admin or dedicated **service** identity — there is deliberately no `system`/unscoped bypass. | | `OS_MCP_SERVER_NAME` | string | `objectstack` | Server name advertised to MCP clients. | | `OS_MCP_SERVER_TRANSPORT` | enum | `stdio` | `stdio` \| `http`. Use `http` (Streamable HTTP) for a remote client; `stdio` for a local one. |