Agent access policy

Public catalog reads do not require an account. Managed installs, publishing, workspace writes and other protected actions require explicit user approval through the local browser authorization broker.

• Access credentials stay in local process memory.
• A rotating refresh credential may be stored only in the operating-system credential store for at most 30 days.
• Refresh reuse revokes the agent session.
• Tokens and browser proofs must not enter prompts, tool results, project files, URL queries, analytics or logs.
• Protected mutations are idempotent and retry only after the same request is approved.
• Failed or ambiguous authorization fails closed.

This local broker is not OAuth and is not an authorization server for the public MCP endpoint.