Agent access, tokens, and the security model

When you connect an AI coding agent to BugMojo over MCP, it doesn't get a master key to your account. Every connection is authorized against a real person, scoped to what that person can already see, and bounded to a narrow set of actions. This page explains how that access is granted, what limits it, and the guardrails you keep as an OWNER or ADMIN.

You don't paste a long-lived API key into your editor. When an agent first calls a BugMojo tool, MCP opens your browser to authorize the connection against your account. You sign in, pick the one workspace the agent may use and what it may do, and approve. The agent receives a scoped token tied to your identity and that workspace. Each editor or machine that connects gets its own authorization, so tokens are per connection rather than shared across a team. You can revoke a connection at any time, which cuts the agent off immediately.

Browser authorization is the default, but some clients have no browser to open. GitHub Copilot's cloud coding agent, the Claude Agent SDK, and anything running in CI cannot complete an interactive OAuth flow. For those, BugMojo's MCP endpoint also accepts an API key:

• Create one under Settings → API Keys. It starts with bm_key_ and is shown once.
• Send it as Authorization: Bearer bm_key_… to /api/mcp, exactly where an OAuth token would go.
• Store it as a secret in your CI or agent platform, never in a committed config file.

An agent never has more access than the person who authorized it, and usually less. Its reach is scoped by:

• The permissions you granted. On the consent screen you choose Read bugs (always included), Read session evidence (replay, console and network logs, repro packs), Create and update, and Administer the workspace. Read only is preselected. A tool the agent was not granted is never offered to it.
• One workspace. The connection is bound to the workspace you picked; it cannot see your other workspaces. Connections made before this existed keep read and write access within your role and are marked for reconnection in Settings → Connections.
• Your role. The agent inherits your role (OWNER, ADMIN, DEVELOPER, QA, or VIEWER) and the permissions that come with it.
• Project membership. The agent can only read bugs in companies and projects you belong to. Bugs outside your access are invisible to it.
• Per-bug evidence. For each bug it can see, the agent reads the same replay context, console logs, network requests, and repro steps you'd see on the bug detail page, with PII already redacted in the browser at capture time.

The MCP surface is deliberately narrow. An agent can read a bug's replay context, console and network logs, and repro steps, and act on bugs it's allowed to touch, for example updating a bug it's assigned to or proposing a fix through an integration. An agent cannot reach projects you can't see, read unredacted PII, or run destructive account actions like deleting a project, removing members, or changing your plan. Those stay in the web dashboard, in human hands.

As an OWNER or ADMIN you set the boundaries. Authorize agents with an appropriately scoped role, revoke any connection you no longer trust, turn AI agents & MCP off for the whole workspace in Settings → Security when you need to (connected clients are refused and BugMojo agents stop running), review connections, bug reads and agent runs in the audit log, and keep a human in the loop: an agent proposes and can ship a change, but a person reviews it and decides whether to close the bug. Nothing is closed automatically.