| Category | Authentication behavior |
|---|---|
| Session, Workspace, and discovery | Configure local MCP session state and do not require an existing bearer token. |
| Authentication | Establish, inspect, or clear the bearer token stored for the MCP session. |
| Health | Forward the session token to Admin APIs; downstream Admin authorization controls access. |
| Cloud and alerts | Exist only when a Google Cloud runner is configured and use its server-side credentials. They do not currently add a separate per-tool bearer gate. |
Ponder (send_ponder_message, await_ponder_reply) | Forward the session bearer token and X-Tenant to web-api’s hand-registered /api/ponder/parable stream and to createParableRealtimeTicket. web-api’s Ponder permission and Problem sight checks decide access. They cannot be generated because the reply is an AI SDK event stream and the wait is a WebSocket subscription. Owned by the MCP server’s internal/ponder package; lifecycle experimental. |
pipeline_status is callable, but its relationship to the current Provider
Pool model is unverified. Treat the name as a compatibility or legacy signal
until its implementation and callers are mapped.