MENSARA.AI · A GOVERNED MIND, IN YOUR ACCOUNT
Sign in
Mensara Create account

MENSARA.AI · PORTAL, MCP AND CLI · MACHINE SURFACE · TEXT/MARKDOWN

---
title: Portal, MCP and CLI
canonical_url: https://app.mensara.ai/how-it-works/portal-mcp-cli
feature: portal-mcp-cli
audience: llm-agent
last_verified: 2026-08-11
availability: available-now
signup_supported: false
interfaces:
  - portal
  - mcp
  - cli
---

# Portal, MCP and CLI

Explains the browser Portal, MCP connection for agents, CLI use, credential issuance, discovery, revocation, and identical gate semantics.

## Concept model

- Portal, MCP, and CLI are interfaces, not separate stores.
- A setup token bootstraps a scoped client credential.
- All interfaces use the same authorization and receipt semantics.

## Capabilities

- Portal: browse, approve, administer, and inspect.
- MCP: expose authorised Mind tools to an agent client.
- CLI: run authorised operations from a terminal or script.

## Prerequisites

- A provisioned Mind reachable at its assigned hostname.
- An owner-issued identity and setup credential.
- For MCP, a compatible client; for CLI, the installed mind command.

## Authorization

- The credential identifies the principal and its grants.
- Tool discovery does not expose inaccessible zones.
- Switching clients does not increase authority.

## Connection or use flow

1. Owner creates or selects a principal in the Portal.
2. Owner generates instance-specific setup instructions.
3. Client exchanges or stores the scoped credential securely.
4. Client discovers allowed tools and makes a small test read.
5. Owner can revoke the credential from the Portal.

## Refusals and recovery

- Invalid or expired setup token: stop and request a new one from the owner.
- Valid identity but missing grant: report HELD and the missing zone or verb.
- Unreachable Mind: preserve the request locally only if the human asked; do not claim it ran.

## Ownership and data boundaries

- The Mind runs in the owner's account; the client and model subscription may be operated elsewhere.
- Client credentials must stay outside prompts, repositories, and shared chat transcripts.
- Responses contain only content visible to the authenticated principal.

## Availability and limits

**Available now** The Portal, MCP server, and mind CLI are available on provisioned Minds.
- Exact setup commands are issued by the owner's own Mind because URLs and credentials are instance-specific.
- A connected model subscription remains separate from the Mind.

## Signup and provisioning

`signup_supported: false`

A human requests the Mind and approves provisioning. Once it exists, the Owner can generate precise MCP or CLI setup instructions for a person or agent.

No autonomous signup or provisioning endpoint is documented because none is offered today. An agent must stop and involve the human owner.

## System diagram

```mermaid
flowchart LR
  P[Portal] --> G{One access gate}
  M[MCP client] --> G
  C[mind CLI] --> G
  G -->|allowed| B[Mind: memory and tools]
  G -->|denied| H[HELD receipt]
```

## Runnable example

```text
1. Ask the Owner for MCP setup instructions for this agent identity.
2. Configure the returned server URL and credential in the client.
3. Discover tools.
4. Run a read-only status call.
5. Store the returned receipt id.
```

## Related

- [Zones and permissions](https://app.mensara.ai/how-it-works/zones-and-permissions)
- [Connections and capture](https://app.mensara.ai/how-it-works/connections-and-capture)
- [Changes, approvals and receipts](https://app.mensara.ai/how-it-works/changes-approvals-receipts)