MCP connection, sign-in and permissions

Identify the Cloud endpoint, inspect local connection availability and distinguish staff DX device login.

Customer Cloud MCP and staff DX MCP are separate protected resources. Use the endpoint and permissions for the account and task you intend to connect.

Check what DDS exposes

  1. Use QUOTA to open DDS settings, then choose Developer access.

  2. In Overview, read the selected project and the requirement for account sign-in, organization consent and permission.

  3. Choose Open setup to open Developer tools and read the setup information and Documentation link.

  4. Expand Details to read the Cloud endpoint, Streamable HTTP transport, authentication requirement and permission labels.

Details lists the following Cloud permission labels. Each scope below uses the https://mcp.altifigence.com/ prefix. Its tool table is a reference; the current organization policy and connection grant determine which tools are actually available.

Shown label

Scope

Read permission

cloud.read

Write permission

cloud.write

Runtime permission

cloud.execute

AI metadata permission

cloud.ai.read

AI inference permission

cloud.ai.infer

AI connection permission

cloud.ai.credentials.write

Context, search & connections contains separate context, Web search and AI-connection settings. Neither that page nor the Developer tools information establishes completed external MCP authorization.

When a Cloud client offers authorization

The customer remote transport endpoint is https://mcp.altifigence.com/cloud-mcp. Its authorization metadata identifies the Cloud authorization server; clients should use discovery for that protected resource. The account and organization shown by the client’s authorization flow must match the intended Cloud project. No DDS settings control substitutes for the external approval flow.

When read tools are available after connection, a small authorized saved-file read can establish the connection’s actual read access. Write, execute and AI permissions remain separate. An old read grant does not acquire new tools merely because the server catalog grows. Current organization policy and the grant limit every call.

Staff DX device login is a different connection

The employee DX endpoint is https://mcp.altifigence.com/dx-mcp. For an eligible staff account and client using the DX device flow, the helper can display an eight-character XXXX-XXXX code and the verification address https://dx.altifigence.com/login/device. Codes are one-use and expire after 15 minutes. They are not Cloud MCP authorization codes.

When a DX device-approval page is available, the app identity, request time, request origin information, requested permissions and lifetime belong to that staff connection. An unrequested code must not be approved. Approval occurs in staff DX and follows its current authentication requirements.

DX uses employee permissions such as docs.read and work.read. Do not mix DX permissions, general gateway tools.* permissions and customer cloud.* permissions. Use the staff guide supplied by your organization for the current DX procedure and authentication requirements.

If access is refused

An expired or revoked connection needs the client’s offered reconnection flow. An insufficient-scope response also requires the relevant current grant and organization policy; signing in again alone cannot create authority. Keep codes, tokens and authorization links private. A server-side 503 does not establish permission or a completed login.

Related guides

ChatGPT connection · Claude Code connection · connection guidance · tool reference · availability · Account security · troubleshooting table