Authentication & permissions

Browser sign-inCopy Anchor Link

The MCP server uses OAuth with a browser consent flow backed by your Oren sign-in. Oren issues MCP access tokens for the approved connection. Your Privy session token is not a substitute for an MCP access token.

You do not need to share a seed phrase, private key or manually copied access token with your agent.

Permission scopesCopy Anchor Link

oren.readCopy Anchor Link

Allows portfolio and stock read tools. Portfolio access is bound to the wallet selected during connection; the agent cannot choose an arbitrary wallet for get_portfolio.

oren.trade.prepareCopy Anchor Link

Allows preparing a buy or sell intent, opening its browser review and checking its status. Preparing a trade does not authorize a signature or broadcast.

oren.trade.executeCopy Anchor Link

Allows requesting execution under a separate, active, bounded wallet delegation when the server has that capability enabled. OAuth consent alone is insufficient. Delegated execution remains restricted during rollout.

Review each new connectionCopy Anchor Link

Every new authorization requires fresh Oren consent, including reconnecting a previously approved client. Token refresh can continue within the existing connection.

The consent screen shows the actual selected callback destination. A client name is not proof of which application initiated the request. Local callbacks require an additional acknowledgement.

Expiry and revocationCopy Anchor Link

Connections currently expire after seven days. Access tokens are also checked against the connection's current state and wallet binding.

Visit Agent connections to revoke a connection. Manage any delegated trading grant there as well; connection consent and wallet delegation are separate permissions. Revocation prevents future authorized use but cannot undo an already broadcast onchain transaction.