> ## Documentation Index
> Fetch the complete documentation index at: https://docs.risos.co/llms.txt
> Use this file to discover all available pages before exploring further.

# MCP security

> Connect AI clients with tenant isolation, least privilege, revocation, and explicit credential boundaries.

RISOS MCP uses a dedicated, workspace-scoped API key as its production authentication mechanism. Give each client its own key with `mcp:use` and the minimum additional scopes required.

Do not share a browser session cookie or provider credential with an MCP client. RISOS provider credentials remain server-side, and provider routing is not exposed as a customer control.

Read tools are isolated to the API-key workspace. Investigation and monitor creation enforce write scopes. Resources return policy-safe canonical data and do not bulk-deliver raw provider payloads.

Revoke a client by revoking its RISOS API key. Rotate keys independently per client and avoid embedding keys in prompts, source files, or public environment variables.