> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rotascale.com/llms.txt
> Use this file to discover all available pages before exploring further.

# MCP SDK

> rotascale-mcp: expose your own tools with authorisation built in, so there is no unguarded path to them.

```bash theme={"system"}
pip install rotascale-mcp
```

Two entry points ship:

| Command               | For                                                                                 |
| --------------------- | ----------------------------------------------------------------------------------- |
| `rotascale-mcp`       | A guarded MCP **server**: your tools, with the gate in front                        |
| `rotascale-mcp-proxy` | A **proxy** in front of somebody else's MCP server. See [the proxy](/sdk/mcp-proxy) |

## Why MCP needs this more than most integrations

An agent platform handing out OAuth scopes is granting a permission it cannot
recall, cannot bound and cannot attribute to a person. A grant has an expiry, a
ceiling and a named human. When the tools an agent reaches are ones you did not
write, that difference stops being philosophical.

## The guarded server

```bash theme={"system"}
export ROTASCALE_URL="https://rotagrant.internal.example"
export ROTASCALE_API_KEY="rsk_..."
export ROTASCALE_MCP_TRANSPORT="stdio"     # or the HTTP transport
rotascale-mcp
```

Every tool call is authorised before it reaches your handler. A refusal is
returned to the caller as an MCP error carrying the outcome and the reason, not
as a generic failure, so the agent on the other end can tell "not permitted"
from "out of allowance" and stop retrying the second one.

## Mapping tools to grants

A server exposing ten tools is not one authority. A read tool and a tool that
moves money should not sit behind the same bound, and putting them there is the
mistake this package exists to prevent.

Grants resolve per tool. A tool with no grant configured is refused rather than
allowed, which is the correct default and the opposite of what most gateway
software does.

## Untrusted by default

Content returned by an MCP tool is untrusted unless you say otherwise. That is
the right default here more than anywhere: the premise of an open tool ecosystem
is that you did not write the thing on the other end.

Where a tool result feeds an action that requires a clean context, gate 5
refuses it and the record names the tool and the step. See
[Clean context](/concepts/clean-context).

## Environment

| Variable                  | Meaning                               |
| ------------------------- | ------------------------------------- |
| `ROTASCALE_URL`           | Your deployment                       |
| `ROTASCALE_API_KEY`       | See [Authentication](/authentication) |
| `ROTASCALE_MCP_TRANSPORT` | `stdio` by default                    |
| `ROTASCALE_MCP_LOG`       | `WARNING` by default                  |