Authentication
The MCP server uses OAuth 2.1, not a shared secret: Clerk is the authorization server, Openpulse is only a resource server that verifies the token and serves data. Connecting an assistant walks you through the standard OAuth consent screen — there is no API key to paste in. This is deliberately different from the API reference, which authenticates with a static bearer token. A workspace API key is built for a script you write once and run unattended; OAuth is built for a client acting on your behalf in real time, where a human is present to grant and later revoke consent.What it cannot do, on purpose
There is deliberately no create, update or delete for listeners over MCP. An agent that can create listeners can commit you to recurring spend on every schedule tick — a mistake this shape of interface makes uncorrectable at conversation speed. The one exception,trigger_run, spends money on a single run rather than creating a standing spend, and is restricted to admins for that reason.
An assistant connected over MCP also cannot see what a run costs Openpulse to produce — that is operational data, not workspace data, and the two are kept apart everywhere in the product, not just here.