Skip to main content

Sign-in and session

An MCP connection on its own is not enough. passo.build needs to know which person, organisation and project the work belongs to, because agent actions create tasks, evidence and release records that must be attributed correctly.

How sign-in works​

  1. Your client connects to the passo.build MCP endpoint.
  2. The endpoint tells the client where to sign in. Your client opens the browser.
  3. You sign in with your passo.build account.
  4. The client stores the session under your user profile, outside any repository, and refreshes it silently.

Your organisation, the projects you can see and your identity are derived from that sign-in on the server. Nothing the agent sends can change which organisation it is acting for.

What the session controls​

After sign-in the agent can:

  • list the projects shared with your account;
  • take tasks from those projects and report on them;
  • read the state of a task to resume after a context reset.

It cannot merge, release, change billing, read secrets or touch your cloud account. Those actions happen in the console, by you.

Keep the session out of the repository​

The session material is a credential. Never commit it, never paste it into a project file, and revoke it from your account if a machine is lost.

If something is wrong​

If the agent is working on the wrong project, stop it and select the right project. If a session looks compromised, revoke it from your account settings and sign in again. Tasks the agent was holding return to the plan for another agent to pick up.