User identity
OAuth subjects partition pantry and recipes for MCP end users.
OAuth resolution
- developer_id ← application owner
- application_id ← MCP application
- user_partition ← OAuth subject
- scopes ← granted consent
API-key path
Trusted servers still use developer API keys with optional X-External-User-ID. External user context.
End-user grants
Users can review connections at /connect.