MCP Integration

Security & FAQ

Tenant isolation, scopes, OAuth deep-dive, and Frequently Asked Questions.

Security & Scopes

  • Every call is scoped to the API key's tenant — no cross-tenant access.
  • Scopes: read (read-only), write (create/update). Grant the least scope needed.
  • Revoke a key anytime in the panel if leaked.
  • Treat the key like a password — never commit it to a public repo.
  • For OAuth: grants are per-user (other tenant members can neither see nor revoke yours), PKCE S256 is mandatory, refresh tokens rotate on every use, and revoking an app under Settings → Connected Apps immediately kills all of its tokens including older refresh tokens.

Getting listed in official connector directories

This is an honest status, not a promise — we haven't yet submitted Oprex to any official directory, so this is guidance based on publicly known requirements, not first-hand experience.

  1. Protocol compliance — already met: MCP 2025-06-18, Streamable HTTP, standard tools/list + tools/call.
  2. OAuth 2.1 — met as of 3 August 2026. Oprex is now its own authorization server: metadata discovery (RFC 8414 & 9728), Dynamic Client Registration (RFC 7591), authorization code with mandatory PKCE S256, refresh tokens with rotation, and revocation (RFC 7009).
  3. Policy & security — directory providers typically require a public privacy policy, a description of what data is accessed, and a formal security review/submission process.

FAQ

Is it free? Yes, included with your Oprex subscription.

Can multiple AIs use it at once? Yes — the same endpoint & key work across all MCP clients.

What about OAuth for claude.ai / ChatGPT web? Available now — see the Setup page.

API key vs OAuth — what's the difference? An API key suits CI/CD and scripts (tenant-owned, valid until revoked). OAuth suits AI apps used by a person (per-user, 1-hour access token, 30-day rotating refresh, revocable under Settings → Connected Apps).

Is 'code indexing' part of Oprex? No. Oprex MCP indexes SDLC data (issues, requirements, test cases, notes, memory). Code indexing is a feature of your editor/agent — for example Kilo Code indexes your local codebase so the agent understands your code's structure. Oprex and code indexing complement each other: one understands the project's history, the other understands the code structurally.