MCP glossary
The terms this surface uses, defined once.
Contract (presentation contract) — the versioned shape of every projection payload; v4
in this release, carried as contract_version on every response.
Data class — one of the two closed scope units (stream-state, cost-data) a token
does or does not carry.
Denial shape — the single byte-identical error body every denial returns; the cause
lives only in the record, keyed by ref.
Front door — the OAuth surface: discovery metadata, /authorize, /token, and the
bearer middleware.
Horizon — which streams a fleet read includes: live (default; open work) or all.
Projection — a rendering of the record; this server is the record's third projection,
after the CLI and the exported artifacts. Never the source.
Self-issued AS — the server's built-in OAuth 2.1 authorization server: PKCE-only,
RS256, 15-minute tokens, no refresh grant.
Trust list (ISSUERS.md) — the human-gated document naming which external issuers may
authenticate callers, with pinned audience and algorithm per issuer.
Tenant slice — the row-level narrowing of the projection to a tenant token's named
streams.
Tool budget — the stacked response-size discipline: live horizon, honest summary, limit
- cursor, tabular formats, and the 200,000-byte cap-as-error.
Virtual path — the access-log resolution of one
POST /mcpwire request into the method/tool actually invoked (POST /mcp/tools/<name>).
MCP administrator's runbook
Prerequisites, the settings with security meaning, what to monitor, and incident response.
Agent security: the whole set
Every control that stands between an agent session and your machine — confinement, tool policy, egress, credentials, and the human gate — and where each one is documented.