Connect and discover

Start with the authorized Streamable HTTP endpoint, its TLS trust chain and an access token for the deployment's MCP audience. Keep the token in the client's authentication configuration. A successful MCP connection establishes transport. Enrollment and scope are checked separately.

Verify identity, scope and the operation contract

1. Connect and identify me uses read_v2_session_identity with {} on an application endpoint. Compare the verified issuer, subject and audience with the account you intended to use.
2. Find my applications uses the router's list_v2_applications. Pass nextAfter as after to continue. Select by the returned workspace and application IDs. A bound application listener already has its scope.
3. Inspect available functions starts with MCP tool discovery, then uses list_v2_functions for the application. Supply both IDs on the router and use {} on a bound application listener. Verify the returned listener scope and review the function's arguments, permission and execution mode.

A protocol tool such as read_v2_program accepts a typed request. Its program.function, such as facts.cube.scan, selects the operation within that tool. If a verified subject receives IDENTITY_INACTIVE, check enrollment. If a function is missing, check the deployment version, endpoint, enabled capabilities and the current grant before proceeding.

If the deployment offers the Multidimensional Cube Harness, check the version and digest before using it. Clients without MCP resource support can read it with read_openepm_published_skill.

Connection prompt templates · Connection tools · HTTPS walkthrough