- OAuth — connect from a browser-capable client (Claude Code, Claude Desktop, Cursor) with no key at all; a browser window signs you in. OAuth sessions act with your full user access, bounded only by your workspace role.
- API key — send
Authorization: Bearer ak_…for headless use. Keys are additionally bounded by their scopes.
The 38 tools
Scope applies to API-key connections; role checks apply to everyone.Workspace & identity
Tasks
Content
Automations
Skills, files & folders
Tools like
search_web, search_x, and generate_image belong to the built-in worker’s in-sandbox toolset — they run while it drafts content and are not exposed on the public MCP server. If your agent needs research or image generation, bring its own.The gate is role-based, not scope-based
A Viewer-role key holdingtasks:write still cannot approve, reject, or publish — those tools check the caller’s workspace role independently of key scopes, and a Viewer’s created tasks always require review. Scopes bound what a key may touch; roles decide who may ship. Keep agent keys on Viewer identities and the review gate holds no matter how the key is scoped.