What it is

MCP is an open protocol for connecting AI clients to external tools and data. We added an MCP server to the Glassmkr dashboard, served over streamable HTTP at https://app.glassmkr.com/mcp. Point a compatible client at that URL, complete a browser sign-in, and it can work with your account through a small, deliberate set of tools. There is nothing to install on your servers beyond the Crucible agent you already run.

Authorization is per-user OAuth 2.1 (authorization code with PKCE). You never paste a Glassmkr password or key into the client; you approve it on a consent screen, and you revoke it from Settings, MCP connections at any time. A revoke, or a password reset, cuts off existing tokens immediately.

Three scopes, granted separately

Access is tiered, and a client only ever has what you approved on the consent screen:

• Read lists your servers, reads a server's latest health snapshot and active alerts, pulls bounded resource-usage history, and reads the fleet summary. This is the tier for "triage my fleet" and "explain this alert."
• Write acknowledges alerts, and resolves the forensic alert types that do not auto-clear (most alerts auto-resolve when their condition clears; those are acknowledged, not resolved). Reversible.
• Administrative enrolls a server, rotates a collector key, or moves a server to trash.

Read went live first, on its own, precisely because it cannot change anything: a compromised or confused client with a read token can look but not touch. Write and admin are separate opt-ins on top. All three are generally available today; you pick which to grant on the consent screen.

Making a destructive tool safe for an LLM

Here is the honest problem. A language model is a probabilistic thing, and we were about to give one a tool named glassmkr.admin.delete_server. And "the client asks for confirmation" cannot be the whole answer, because the model is the one driving the client. So the safety is a stack of independent controls, and the real human-in-the-loop is your client's own approval prompt, not anything the model types:

• A scope you granted. Admin tools require the glassmkr:admin scope, which you approved by name on the consent screen. A read or write connection cannot reach them at all.
• A signed, two-step token. A destructive action is never a single call. The client first calls glassmkr.admin.prepare, which returns a short-lived token bound to that exact account, action, and target; the action requires the token back and the target's name echoed. The model supplies both, so this is not itself a human check: it forces a deliberate two step and binds the action to one specific server, so a stray or prompt-injected single call cannot act on the wrong one.
• Your client's approval prompt. This is the actual human gate: a person approves the tool call in the client before it runs. The controls above make that approval specific and hard to fumble; they do not replace it.
• Delete does not destroy. A delete over MCP is a soft delete: the server moves to trash and is restorable from the dashboard, not wiped. The truly irreversible path stays in the dashboard, behind a human.
• Telemetry is untrusted input. Hostnames, alert text, and other host-derived strings come from monitored machines, so every tool result labels those fields as untrusted and instructs the client never to follow instructions found in them. A box cannot talk your assistant into doing something through its own hostname.
• Everything is bounded and logged. Mutations respect the same per-action rate limits as our REST API, tenant isolation is enforced on every call, and every tool call lands in your audit log.

None of these is novel on its own. Stacked, they turn "an AI can delete your server" into "an AI can move a server to trash, only with a scope you granted, only behind your client's approval prompt, only via a signed two-step bound to that one server, and only in a way you can undo and audit." That is a boundary we are comfortable shipping.

How to connect

Add https://app.glassmkr.com/mcp as an MCP server in your client. It will send you to Glassmkr to sign in and review exactly which scopes it is asking for; approve, and the connection appears under Settings with a revoke button. The client discovers the OAuth endpoints automatically from the standard metadata documents, so there is no manual configuration beyond the URL.

The full tool catalog, the trust boundary, and the confirmation flow are documented in the MCP server guide. If you want the same operations from a script instead of a conversation, the programmatic API covers the same ground.