Authentication
Web app MCP (honest matrix)
| Principal | How resolved | Status |
|---|---|---|
| Public | No Authorization header (or empty Bearer) | Shipped — community + travel tools (Grok default) |
| Admin | Authorization: Bearer <ADMIN_API_TOKEN> (constant-time compare) | Shipped — full web tool list including bot-proxy admin tools |
| Member | Authorization: Bearer hovmcp_… — a Discord-linked personal token (HMAC-signed, bound to member_profiles.discord_id) | Shipped (2026-07-17) — resolveMemberPrincipal verifies the token + live linkage and returns a self-scoped member principal (public + member tools, never admin). Unlinking Discord revokes it. Any invalid/mismatched bearer → 401 (never falls back to public) |
Production fact
- Omit Authorization for public community + travel tools (
tools/listand publictools/callwork without a token). - Pass admin bearer only when you need admin/ops tools.
- A non-empty invalid Bearer is 401, not public — wrong tokens do not silently open the public catalog.
Visibility (shipped)
| Tool | Flag | Access |
|---|---|---|
community_overview | public | public / member / admin |
builder_path | public | public / member / admin |
leaderboard | public | public / member / admin |
member_stats | public | public / member / admin (a member-principal caller self-scopes to their own Discord id; a discord_id/user_id argument is ignored for members) |
upcoming_events | public | public / member / admin |
open_quests_and_bounties | public | public / member / admin |
hangout_info | public | public / member / admin |
search_stay_packages | public | public / member / admin |
search_month_hops | public | public / member / admin |
hangout_status | admin | admin only |
list_scheduled_events | admin | admin only |
| Other bot-proxy ops tools | admin | admin only |
Bot-service admin MCP
| Rule | Detail |
|---|---|
| Auth | Always ADMIN_API_TOKEN via requireAdminRequest |
| Public access | None |
| Tools | Full admin catalog — see Admin tools |
Secrets hygiene
- Never put
ADMIN_API_TOKEN, Supabase service role keys, or bot tokens in client bundles or this docs site. - Configure bearer headers in the MCP client's secret slot.
- Rotating the admin token invalidates all admin MCP clients immediately.
Error shapes
| HTTP | Meaning |
|---|---|
| 401 | Invalid non-empty Authorization (wrong token / member seam null) — body includes onboarding URL https://houseofvibes.app |
| 405 | GET or non-POST |
| 500 | Unexpected server error |
JSON-RPC error | Protocol errors inside a 200 JSON-RPC envelope |