Assistant and MCP integration

OrgMemory offers two AI-facing experiences. The in-product Assistant streams grounded answers and controlled Asset actions. The MCP server exposes a stateless, authenticated delivery adapter for external clients. Both reuse canonical API authorization instead of owning repositories or policy.

In-product Assistant

Every chat turn performs fresh permission-aware retrieval. The server verifies the complete chunk/entity/relation evidence closure, renders one bounded prompt, and assigns citation numbers in the same order. The browser makes interactive only markers declared by the server.

Conversation transcripts and model context are separate. The transcript keeps actor-owned history for list, replay, rename, and delete; the bounded model window keeps recent chat context. Current evidence is retrieved again for every turn and is not copied into long-term model memory.

Asset actions use a closed allowlist. The Assistant may discover exact releases, search Knowledge, render/run Prompt Templates, guide Work Instructions, manage a user's Pack progress, fork a release, and submit feedback. Provider calls and state changes require explicit confirmation. It cannot approve, publish, withdraw, change permissions, or execute arbitrary code.

MCP protected resource

The MCP endpoint publishes RFC 9728 protected-resource metadata. Public clients use Authorization Code with PKCE S256 and user consent through restricted Dynamic Client Registration. The resource validates issuer, expiry, and exact audience, then the confidential MCP gateway exchanges the user token for a short-lived API-audience token. The inbound bearer is never forwarded.

Read-only delivery requires assets:read. Bounded Skill Draft publication is a separate HTTP companion requiring assets:write; it is not an MCP mutation tool.

Tools and resources

The current surface includes permission-aware search_knowledge plus eight Asset tools:

• search_assets, get_asset, and get_asset_release;
• get_skill_manifest and resolve_skill;
• get_capability_pack and resolve_asset_relations;
• deterministic render_prompt.

It also provides:

• orgmemory://assets/{assetId};
• orgmemory://assets/{assetId}/releases/{releaseId};
• the generic released_prompt prompt adapter.

Outputs contain immutable delivery projections only. Drafts, reviews, roles, governance history, object-storage keys, Prompt variables, and denied component identifiers do not cross the boundary.

Connect a client

{
"content": [
  { "type": "text", "text": "Permission-filtered result" }
],
"structuredContent": {
  "releaseId": "exact-immutable-release-id"
}
}

Skill CLI boundary

The Node 24 CLI discovers an exact Skill release through MCP, downloads the binary through the protected companion route, verifies archive and per-file digests, and installs through an adjacent staging directory. Local validation and skill publish --dry-run require no authentication or network access.

A real publication requests the write scope and creates only a Draft. Review, approval, and release remain explicit governance actions in the web product.

Failure and privacy behavior

• wrong issuer, audience, expiry, scope, or live object authorization denies;
• denied IDs and API denial bodies are collapsed into generic tool failures;
• per-caller and process-wide rate limits bound the resource;
• citation and Skill bytes are proxied; storage URLs are never exposed;
• delivery audit records actor, organization, action, Asset, and release identifiers without tokens, variables, or payloads.