The connection between the AI service and the Alfabet MCP Server is established using modern OAuth 2.1 authentication with dynamic client registration. As a result, no client credentials need to be configured manually on either the server or the AI service. Authentication is handled automatically when the connection is established.
In addition to the service-level authentication, the Alfabet MCP Server enforces user authentication and authorization. Only registered Alfabet users can access data through the MCP server.
Users must already be signed in to the Alfabet user interface when the connection to the MCP server is established. Once the connection has been authenticated, the browser session used for login can be closed without affecting the active MCP server session.
Access to MCP server functionality is governed by the same permissions that apply to the Alfabet REST services. Users can only access MCP tools that rely on REST service endpoints for which they have the necessary permissions. If a user has access to only a subset of the available REST service endpoints, the MCP server remains available but its functionality is limited accordingly. Requests are processed only through tools and endpoints that the user is authorized to use.
Access to Alfabet object data follows the standard Alfabet security model. The information available through the MCP server is determined by both the REST service permissions assigned to the user and the role-based access rights defined in Alfabet . As a result, users can view and work only with data that they are already authorized to access in the Alfabet user interface. Additional restrictions configured for the Alfabet REST services are also respected by the MCP server.