What a project member receives after deploy. Keep this list short so operators do not accidentally over-share.
Members receive
- MCP address — HTTPS Streamable HTTP URL for their project alias, e.g.
https://team.example/v1/projects/<alias>/mcp. - Personal credential claim method — how to obtain their bearer safely:
- Operator (or project admin after first admin) generates a credential with
awr-server access token --credential-id <id> --output /secure/<id>.token(mode0600, never overwritten). - Deliver the bearer out of band (encrypted channel / one-time secret store). Register only
secret_hashin PostgreSQL. - Member sets a local environment variable (e.g.
AWR_TEAM_BEARER) and points their client config at that env — never pastes the bearer into Git, chat logs, MCP tool arguments, or audit-visible fields.
- Operator (or project admin after first admin) generates a credential with
- Repository — Git remote for ordinary PR contributions to source/contracts.
Members must NOT receive
| Forbidden | Why |
|---|---|
PostgreSQL accounts / AWR_TEAM_DATABASE_URL | App and owner DB roles are ops-only |
Schema-owner / awr-server access on the server | Recovery and first-admin stay ops |
| Ledger-directory write access on the host | Registry writes go through the publish entrypoint |
| Raw credentials in MCP messages or shared configs | Secret boundary (secret-boundaries.md) |
After claim
Configure one of the WS-024 named clients:
Example templates: examples/team-mcp-deploy/.
Confirm with awr_team_query → {"protocol_version":1,"op":"capabilities"} before any mutation. Closing the MCP connection does not end a durable Team session.
