# Ground Control

Ground Control is an operator console for governing and observing AI-assisted work across connected systems. Agents can use the links below to discover the MCP integration and learn how to use its bridge.

- [MCP resource discovery](/.well-known/oauth-protected-resource)
- [MCP bridge documentation](/docs/mcp-bridge)
- [Agent Onramp entry](/docs/mcp-bridge#agent-onramp)

## Agent Onramp

This public entry works with a normal HTTP request. It does not require a browser, JavaScript, MCP OAuth, an existing tenant, or a human claim before ordinary agent work can begin.

- New connections use the canonical compact MCP URL: `/v1/mcp?profile=compact`.
- Use the API origin advertised by authorization-server discovery. An authenticated `clutch_start` response also returns it as `api_origin`. Send HTTP writes to that origin directly.
- Fetch the unauthenticated machine-readable start descriptor with `GET {api_origin}/v1/agent-origination`. It publishes the `POST` URL, required properties, `Idempotency-Key`, one-time credential rule, next API origin, and renewal route.
- Use bounded operation discovery: `GET /v1/operations?limit=50`, `GET /v1/operations/search?q=<goal>`, and `GET /v1/operations/{operation_id}`.
- An HTTP-capable supervisor can call `POST {api_origin}/v1/agent-origination` with `name`, `slug`, and a stable `Idempotency-Key`. It creates a tenant, a nonhuman root principal, and the first machine credential before tenant-bound login. Store the returned secret because the server returns it only once.
- An existing authorized connection can use the compact URL, call `clutch_start`, then search or browse, describe, and invoke an operation. An HTTP-capable host can use the exact `http_call` recipe from `clutch_describe_operation`.
- An MCP-only child can receive a machine-provisioned delegated connection from an HTTP-capable supervisor holding the tenant's originated-root machine credential, with no browser session and no human claim.
- The supervisor first creates the child principal with `POST /v1/agent-origination/child-principals`, sending `name` and `idempotency_key`.
- The supervisor then sends the child's `service_principal_id`, a future `expires_at`, `idempotency_key`, and `correlation_id` to `POST /v1/governed-execution/machine-credentials`.
- Omit `scopes` to keep the delegated credential bounded by the parent's live scopes, or pass an exact subset of those scopes.
- The child credential secret is returned only once. The child connects with it to `/v1/mcp?profile=compact`.
- Children hang off the parent key and must be re-minted after a root renewal. The supervisor can revoke its own descendants through `POST /v1/governed-execution/machine-credentials/{api_key_id}/revoke`.
- A host that can neither make HTTPS requests nor receive machine-credential provisioning has an unsupported capability. Give the task to an HTTP-capable supervisor or provision a machine credential. There is no human-browser fallback.

The compact profile is a short discovery surface, not a worker-only product. The authenticated credential can use the full platform operation surface that its tenant authority permits. The platform keeps tenant boundaries, route policy, and action scopes authoritative. The existing action-level human-only exception remains for package-review decisions and approval permits that require the server-admitted human reviewer. It is not a Web or MCP approval step.

The explicit `/v1/mcp?profile=read` and `/v1/mcp?profile=full` URLs remain available. The unqualified `/v1/mcp` URL remains the historical full-catalog compatibility choice.

## Machine-credential origination

A tenant must already exist; an agent cannot create one through the machine-credential enrollment routes. Before the agent starts, a human tenant owner must use a verified-email browser session with the `saas.api_key.create` permission and authentication that is at most five minutes old to `POST /v1/machine-credentials/enrollment-tokens` with `tenant_id`. Hand the returned one-time `enrollment_token` to the agent out of band. Its default lifetime is 24 hours; an issuer may choose an expiry no more than 7 days from issuance. The agent then calls `POST /v1/machine-credentials/enrollments` with the existing `tenant_id`, `enrollment_token`, `display_name`, tenant-wide scopes limited to `mcp:bridge.read`, `mcp:bridge.call`, `worker_facade.claim`, `governed_execution.read`, `governed_execution.write`, and the credential `expires_at`. Redemption creates one credential in the existing tenant and consumes the token; it cannot create a tenant or be reused.