MCP servers

Mint itr_rt_* in Settings → Runtime API keys. Keep upstream secrets in the Provider vault; clients should not need vendor sk- keys.

Call https://intertrace.fly.dev/mcp with Bearer itr_rt_* + X-Intertrace-MCP-Server, or https://intertrace.fly.dev/mcp?server=YOUR_SERVER_KEY when the client can only send Authorization (Devin). Register servers in Dashboard → MCP. Cursor and Claude Desktop keep using initialize. New MCP SDKs send MCP-Protocol-Version: 2026-07-28 and can call tools without a handshake.

# Existing apps
curl -sS https://intertrace.fly.dev/mcp \
  -H "Authorization: Bearer itr_rt_…" \
  -H "X-Intertrace-MCP-Server: YOUR_SERVER_KEY" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"docs","version":"1"}}}'

# New SDKs: no initialize
curl -sS https://intertrace.fly.dev/mcp \
  -H "Authorization: Bearer itr_rt_…" \
  -H "X-Intertrace-MCP-Server: YOUR_SERVER_KEY" \
  -H "MCP-Protocol-Version: 2026-07-28" \
  -H "Mcp-Method: tools/list" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{"_meta":{"io.modelcontextprotocol/protocolVersion":"2026-07-28"}}}'

Intertrace adds the server's credential to each allowed call, so agents never hold it. A server's Whose account setting (MCP → the server → Whose account) says which credential: one shared account (the default: the sign-in or token saved on the server) or each person's own account. Each person's own account works for a remote MCP server that signs in with OAuth and for an API tools server that signs people in with OAuth.

With each person's own account, a call runs as the person it is for: the person who signed in on /mcp, or the developer whose coding tool made it. That comes from the key the gateway verified, never from a header the client sends. People connect their account once under Your accounts on the MCP page (Connect, Reconnect, Disconnect). Someone who has not connected theirs gets a refusal with the link to connect (PERSONAL_SIGN_IN_REQUIRED), and nothing is sent to the server: the shared account is never used for them.

An agent with its own key acts for no person, so its calls are refused (PERSON_REQUIRED) unless an admin turns on the service account for the server, which then uses the shared account for those calls only. Admins see who connected their account and when, and can revoke one; each change is in the audit log. A revoked account stops being used within a minute. Each tool call's record names the person whose account was used.