Povento Connect

One secure way for agents to understand and operate a governed portfolio.

Povento MCP gives an authorized agent bounded portfolio and project context, then guides capability work through discovery, preflight, plan review, explicit confirmation, and durable receipts.

Canonical public hosthttps://povento.com/mcpThe resource and token audience remain canonical even when this page is served from an interim test host.

The boundary

Useful context. Deliberate permission.

Povento MCP is a contract-based agent access layer, not a private repository shortcut. It never gives an agent provider secrets, static API keys, or a way around account, project, environment, capability, or permission checks. Available, selected, configured, provisioned, verified, and released stay distinct.

The build profile

Reads, project control, and bounded analytics.

Writes require confirmation
01

Account and portfolio

owner.list_portfolios · owner.get_portfolio

Inspect the portfolios and portfolio summaries available to the authenticated owner.

02

Project inventory

owner.list_projects · owner.get_project

List and inspect projects within the effective account and membership scope.

03

Project context

owner.get_project_context · owner.get_project_configuration · owner.get_project_passport

Read a bounded project-context passport and the exact public runtime footprint without secrets or unbounded customer or provider content.

04

Web analytics

owner.get_project_analytics

Inspect project- and environment-scoped event summaries and bounded event projections when analytics is adopted.

05

Capability planning

owner.get_launchpad_catalog · owner.preflight_project · owner.plan_launchpad

Discover live options, check readiness, and create a reviewable plan before any consequential change.

06

Confirmed operations

owner.apply_launchpad_plan · owner.get_operation

Apply an unchanged supported plan only after explicit confirmation, then recover from its durable receipt.

07

Project management

owner.create_project · owner.update_project · owner.archive_project

Create, edit, and reversibly archive projects with explicit confirmation, a reason, and an idempotency key.

Least privilege

Start with two read scopes; add only what an action needs.

account:read

Read the authorized account and portfolio context.

projects:read

Read projects and bounded project context within effective membership and project scope.

projects:write

Create, edit, or archive projects after explicit confirmation.

runtime:read

Read adopted runtime configuration and project web analytics.

runtime:write

Include selected runtime capabilities when creating a project.

Connect safely

Two ways in. One scoped session.

01 · Browser

OAuth with PKCE

  1. Open Protected Resource Metadata and follow its authorization server.
  2. Confirm the issuer, endpoints, authorization-code grant, and S256 support.
  3. Use an exact registered redirect URI, state, PKCE, and resource https://povento.com/mcp.
  4. Sign in and approve only the requested scopes and permitted account, project, environment, and capability context.
02 · Terminal or headless client

Device login

  1. Start a device request at /device/authorize for the canonical resource and requested scopes.
  2. Open the returned verification URI and enter the displayed user code.
  3. Approve at /device/approve, then poll /oauth/token.
  4. Send the resulting bearer only to https://povento.com/mcp; honor expiry and revocation.

Keep credentials in the client’s secure store. Never paste a bearer credential into prompts, page forms, URLs, or tool arguments. Device approval is user authorization—not a static API key.

Protocol links

Start with the machine-readable metadata.

These links are public documentation and discovery surfaces. They do not prove that a client is authorized. Start from Protected Resource Metadata, then use OAuth with PKCE or the device flow.

Agent discovery/.well-known/agent.jsonAgent card/.well-known/agent-card.jsonAPI catalog/.well-known/api-catalogOpenAPI/api/developer/openapiProtected Resource Metadata/.well-known/oauth-protected-resource/mcpProtected Resource Metadata fallback/.well-known/oauth-protected-resourceOAuth Authorization Server Metadata/.well-known/oauth-authorization-serverMachine MCP endpoint/mcpPovento agent skill/skill.mdFull agent guide/llms-full.txtCanonical OpenAPIhttps://povento.com/api/developer/openapiMCP authorization specificationmodelcontextprotocol.io