{"status":"ok","instance":"per caller","baseUrl":"per caller","tenancy":"PER CALLER - the Mautic is resolved from the token's own company_id through the backoffice on every request, and no instance is shared between two companies","credentials":"PER CALLER - each request gets its OWN credential for the single host that caller's company_id resolved to, from Doppler mautic/prd on a miss or from this process's own one-at-a-time fetch cache on a hit; never a fleet list. Concurrent requests from different companies each hold their own credential for the life of that request - a stronger guarantee, one credential in the whole process at any moment, needs a broker process holding no credential in the gateway at all (ADR 0008's named target).","credentialSource":"reachable","toolsOverHttp":74,"toolsTotal":77,"stdioOnly":["mautic_connect","mautic_select_instance","mautic_forget_instance"],"authentication":"REQUIRED on /mcp - a live bearer, audience-checked against this resource (RFC 8707), bound to a company. Scope IS enforced per tool (block A4): all 77 tools are classified read or write, a mautic:read token is refused before dispatch on any write tool, and its Mautic instance additionally refuses any HTTP method but GET.","confirmedActions":"companies:1","access":{"readTools":32,"writeTools":38,"deleteTools":7,"unclassifiedTools":[],"rule":"anything with an external side effect is a write, including sending an email and adding a contact to the do-not-contact list. An unclassified tool is refused."},"verify":{"key":"set","tools":{"read":2,"write":2},"scopes":{"read":"verify:read","write":"verify:write"},"routes":["/verify/upload/","/verify/download/"],"transferTimeoutMs":900000,"requestTimeoutMs":960000},"oauth":{"issuer":"https://mcp.datainnovation.io","resource":"https://mcp.datainnovation.io/mcp","scopesSupported":["mautic:read","mautic:write","mautic:delete","verify:read","verify:write"],"endpointsLive":["/.well-known/oauth-protected-resource","/.well-known/oauth-authorization-server","/oauth/register","/oauth/authorize","/oauth/token","/oauth/revoke","/oauth/connections"],"endpointsMissing":[],"store":"file","backoffice":"configured","userRecheck":"ON - the portal is re-asked on every refresh whether the account is still active and still mcp_enabled","googleSignIn":"ON - the consent page offers Continue with Google, resolved to a portal user by email"},"auditTrail":"ON - one row per tool call (including failures), per A4 refusal, per revocation and per rate-limited call. Recorded: who (client, user, company, token hash), which tool, read or write, and the outcome. NEVER recorded: tool arguments, responses, or any token. Rows are kept 365 days.","limits":{"maxBodyBytes":1000000,"maxBatch":20,"ratePerMinute":120,"ratePerMinutePerToken":60,"ratePerMinutePerTokenCounts":"tool calls, not HTTP requests - a batch of N tool calls costs N"}}