Local OSS
Embedded Node and Python execution is key-free. Adding a key or endpoint configuration does not activate a hosted transport. Explicit remote execution is a separate API.
Dashboard sessions
Browser sessions identify a user and authoritative organization membership. Local login forms exist; hosted login depends on host identity and mail configuration.
Hosted dashboard sign-in — unavailable
Customer API keys
Customer fallback keys are organization/environment scoped credentials with separate lifecycle controls. Public issuance and production scope admission are unavailable. They are not browser sessions or upstream provider credentials.
Hosted API key issuance — unavailable
Keyless machine authentication
Opt-in local token/proof and workload identity exchange interfaces exist. Keys and registrations refresh outside tool calls. Replay and rate state are process-local; live identity-provider and hosted qualification are unavailable.
Hosted machine identity registration — unavailable
Producer secrets
Third-party API credentials belong in explicit host connection bindings. Never place provider secrets in model context, tool arguments or public docs. A connection handle selects an authorized binding; it is not a credential.
Specification
Read the published modes guide and the guard loop.