Alter Vault | The Authorization Layer for AI Agents
The authorization layer for AI agents: credential vault, policy engine, agent identity, human approvals, and a tamper-evident audit trail for every request.
https://alterauth.com/Opens ChatGPT on the web or desktop and asks it to use the WebMCP tools available here.
Connect straight to this server’s public endpoint.
https://mcp.alterauth.com/mcpWe add this server to your workspace, then open Studio — saved access, one connection to many servers, with a history of what ran.
Last probed Sep 14, 2026 · mcp.alterauth.com
13tools discovered
List Phases
List the lifecycle phases this server serves (setup, modify) and what each is for.
List Skills
List the guidance Skills available on this server, with the phase each serves. Read a skill via its resource (skill://alter/<name>).
Get Started
Begin or change an Alter integration. Without args: lists the phases. With `phase`: returns that phase's flows + a heuristic hint — classify the use case YOURSELF and call again with `goal` for the plan. If the use case spans multiple flows, run them sequentially.
Next Step
Return the next step for a flow. Pass the goal (flow id) and the id of the last completed step (omit `after` for the first step). Run each step's detect command FIRST and skip the run command when detection passes. The design step also returns that flow's complete starter ALTER_INTEGRATION.md.
Sdk Integration
Return the Alter SDK wiring (install + client init + request) to write into the developer's codebase, for a language and setup goal.
Sdk Pattern
Return a runnable Alter SDK call pattern for a language: `proxy-call` (zero-egress proxy_request + HITL), `resolve-grant-by-user` (call as an end user via their delegated grant), or `delegate-managed-secret` (the operator-side delegation step). Use AFTER `sdk_integration` has wired the client.
Troubleshoot
Map a @alter-ai/cli exit code or error message to a remediation.
Verify Integration
Return a copy-pasteable recipe to VERIFY an integration works: `first-call` (code↔design, an audit row, correct attribution) or `per-user-isolation` (a multi-user/broker server runs two users under different credentials and rejects cross-user access). Guidance only — you run the commands.
Fetch Doc
Fetch a page from the bundled onboarding SUBSET of the Alter docs by slug (e.g. "quickstart"). Pages outside the subset are identified with the docs-site URL where they live (they are not missing — read them at that URL). Accepts any spelling the docs use: a bare slug, a leading slash, a #section anchor, a full docs.alterauth.com URL, or an older path that now redirects. Omit the slug to list the bundled subset.
List Providers
List every provider with an ingested API spec in Alter's provider-spec catalog, with each spec's source and freshness. Optionally filter by `kind`. Start here, then call list_operations for a provider's operations.
List Operations
List the API operations a provider exposes, live from Alter's provider-spec catalog (e.g. "what can I call on google?"). Returns operation ids + methods/paths, plus the spec's source and freshness. Omit `kind` to auto-detect the provider family; when the id exists in both oauth and managed you'll be asked to pass `kind`. Machine-readable rows ride in `structuredContent` (see this tool's outputSchema) — read those rather than parsing the prose.
Get Operation Schema
Fetch one provider API operation's full contract — method, path, parameters, request/response schemas — live from Alter's provider-spec catalog, plus the spec's source and freshness. Get operation ids from list_operations first.
Policy Language
The authoritative grammar of Alter's policy language, live from the deployed backend: every authorable rule type with its JSON body schema, caps, authorable levels, worked examples, and fail-closed semantics. Call with no arguments for the overview; pass `rule_type` (e.g. "content_match") for one type's full grammar. Use it before authoring rules with `alter policy rules create` (workflow prose: fetch_doc("guides/set-policies") and fetch_doc("reference/cli/commands/policy")).
Get your MCP into directories
A working endpoint is step one. Directory coverage is the coordinated launch across ChatGPT, Claude, Cursor, the MCP Registry, and community indexes.
Directory coverage for brandsThe authorization layer for AI agents: credential vault, policy engine, agent identity, human approvals, and a tamper-evident audit trail for every request.
Use the MCP endpoint listed on this page in your MCP client configuration. One-click install pills support Claude, Cursor, VS Code, and other hosts. Copy the remote MCP URL if your client needs a manual entry.
Operate alter-onboarding? Verify ownership to take over this directory entry.
This server appears in the MCPBundles directory. Verify you operate it to take over the listing — name, description, logo, contact email, and skill content. We email a 6-digit code to a maintainer address your server publishes in /.well-known/security.txt or /.well-known/mcpbundles.json. Free, takes about a minute.
MCPBundles probed 13 tools on the live server. The tool list on this page reflects what was discovered at the last refresh — connect your client to see the full set available to your session.
No provider sign-in was required during MCPBundles' probe. Your client may still need MCPBundles credentials depending on how you connect.
MCPBundles is an independent platform built on the open Model Context Protocol standard. Not affiliated with Anthropic PBC or Claude.