Quickstart

From a connection artifact to a first successful authenticated tool call — using only this public portal.

Before you start

1. Complete Connect so you have either a remote MCP URL + token, a deeplink, or a local stdio config.
2. Confirm the pack you need is marked available on Integration Surfaces.
3. Keep signing material on the peer. Clients hold Bearer tokens, not wallets.

1. Point the client

Remote (preferred for shared environments)

Configure your MCP client with:

• URL: the HTTPS MCP endpoint from Connect (Streamable HTTP)
• Auth: Bearer token (see step 2)

Local stdio

Use the command and environment from the operator install config. Stdio is for trusted machines only.

2. Authenticate

Remote calls send:

Authorization: Bearer <short-lived-token>

The token must be audience-bound to your Legate resource URI. Details: Authentication.

Unauthenticated remote calls receive 401 with a WWW-Authenticate challenge pointing at protected-resource metadata.

3. First tool call

1. List tools your client exposes from Legate (client-specific UI or MCP tools/list).
2. Call a read tool covered by legate.read (for example a channel or chain-info style query your pack publishes).
3. Expect a structured JSON result. On failure, match the status to Errors.

You have succeeded when a read tool returns without 401 / 403 and the result matches a Live surface.

4. Writes (when entitled)

Production writes follow this client sequence only:

1. simulate — dry-run / endorsement preview
2. prepare — unsigned or partially signed proposal + review payload
3. External signature — human or dedicated signer (not a hot key inside the MCP process)
4. submit_signed — commit the signed proposal

Write scopes require an explicit consent claim on the token. Hot-wallet invoke inside the MCP process is not a production path.

Checklist

• Connection obtained without exporting signing material
• Client pointed at the issued MCP URL or stdio config
• Bearer token present for remote calls
• First read tool succeeds on a Live surface
• Write path (if used) follows simulate → prepare → external sign → submit_signed