Tenant-scoped remote MCP — authentication foundation

Connect external MCP clients through WorkOS, enforce tenant and user access, and verify read and write permissions with harmless tools.

What you are reviewing

The complete MCP foundation journey: client setup, WorkOS connection consent, harmless access demonstrations and recovery from denied or unavailable access. No new Platform screen is proposed.

What feedback helps?

Are the proposed MCP permissions and access rules appropriate? Do the harmless checks demonstrate enough for this foundation? Are DataDescriber's responses and the rules for expired sign-in, withdrawn access and temporary service failures clear? Client and WorkOS layouts are outside this review.

How to explore

Choose a scenario and read the current instruction. The selected scenario stays fixed as its screens advance.
Use product controls to follow the journey. Review-toolbar actions simulate background events when a scenario declares them.
Restart resets the scenario and cancels pending work. Guide returns here. Next scenario can skip ahead; Finish review does not record approval.
Guidance can be collapsed beside the preview. Theme changes the viewer and product surfaces without restarting the journey.