Skip to content
ALIGN

Remote MCP and OAuth

Agents on your laptop use the local MCP server that align init registers (Packs and MCP tools). An agent that runs elsewhere connects to the same seven tools over HTTPS.

The endpoint

https://align.bharatreachdsp.com/api/mcp

Give this URL to an MCP client that supports remote servers with OAuth. It finds the rest itself: /.well-known/oauth-protected-resource/api/mcp and /.well-known/oauth-authorization-server describe the server, and the client registers itself (or publishes its details at an HTTPS address). Sign-in uses OAuth 2.1 with PKCE; the only scope is mcp.

Approving an app

The client opens a page Connect an app in your browser (sign in first if needed). It names the app and says whether its details are verified by the site that publishes them or are just what the app says about itself. Choose the Organisation, then Approve or Deny.

An approved app can:

  • read the decisions and open questions of repositories you can read;
  • propose a decision for you to confirm later (only you see it until you do);
  • open a question for your team.

It cannot confirm, reject or change a decision, read anyone's transcripts, or see proposals that are not yours. Remote agents have no working directory, so they name the repository (owner/name) in each call.

Tokens and limits

  • An access token lasts an hour and is renewed with a refresh token, which lasts 30 days and changes on every use. Reusing an old refresh token, or an authorization code twice, revokes the whole connection.
  • The same limits as on the laptop: 120 tool calls a minute per person, record_decision 30 an hour, ask_owner 5 an hour and 20 a day.

Revoking access

In the console, Your settings → Connected apps lists the apps you connected, their organisation, when they last renewed and until when they can. Revoke ends an app's access at once: its next call is refused.