Skip to main content
RISOS MCP uses a dedicated, workspace-scoped API key as its production authentication mechanism. Give each client its own key with mcp:use and the minimum additional scopes required. Do not share a browser session cookie or provider credential with an MCP client. RISOS provider credentials remain server-side, and provider routing is not exposed as a customer control. Read tools are isolated to the API-key workspace. Investigation and monitor creation enforce write scopes. Resources return policy-safe canonical data and do not bulk-deliver raw provider payloads. Revoke a client by revoking its RISOS API key. Rotate keys independently per client and avoid embedding keys in prompts, source files, or public environment variables.