BEON PASS

npx add-mcp 'https://beonpass.com/mcp'

Connect once.Work with control.

A practical guide to connecting your tools and managing access for people and AI.

What BEON PASS is

One access wallet for people and AI.

BEON PASS connects service accounts to compatible AI clients through the Model Context Protocol (MCP). Connect a provider in your wallet, authorize an AI client, and use the tools available to that account. Your repositories, projects, deployments, and other resources remain with their providers.

How a request works

1. You connect an account. The provider authorizes BEON PASS to access the resources and capabilities you select.
2. You connect an AI client. Sign in to BEON PASS and review the client's authorization request.
3. The client discovers tools. Availability depends on connected accounts, wallet context, permissions, provider scopes, and plan access.
4. BEON PASS checks the request. It resolves the account, enforces applicable access controls, and calls the provider. The result returns to your AI client.

Connecting an account and authorizing an AI client are separate steps. A connection does not give every person or AI unrestricted access.

Get started

1. Open beonpass.com. Use Continue with passkey if you already have one. For a new account or email fallback, use Sign up / Can't use a passkey? and follow the sign-in link sent to your email.
2. Complete the sign-up prompts. You can add a passkey for future sign-ins; keep recovery options available.
3. In Tools, select Add account next to an available provider. Choose the intended provider account and review its permissions.
4. Complete the provider's authorization flow and return to BEON PASS. Confirm the account is connected.
5. Connect an AI client using the instructions below. Start with a read-only request to confirm the account and wallet.

Start small. Use a test project or repository and the minimum access your task needs. Provider limits and charges still apply.

First request

Use BEON PASS to identify my account and list my connected providers.
Do not make any changes.

You can use a personal wallet on Free with up to three active personal accounts. Pro enables unlimited personal accounts, personal Autopilot, and advanced personal access and Activity. Organization features use Team access. Check Billing for your current plan and any included-access period.

Connect to Claude

Use Claude's remote MCP connector flow. Availability and the ability to add a connector depend on your Claude account and organization policy.

1. Open Claude's Connectors area, under Customize or Settings depending on the client.
2. Choose Add custom connector. Enter BEON PASS as the name and the remote server URL below.
3. Use the detected OAuth sign-in flow. Sign in with the same BEON PASS account that holds your connections, then review and authorize the client.
4. Enable the connector for your conversation. Ask it to list your connected accounts before taking action.

https://beonpass.com/mcp

In a managed Claude workspace, an administrator may need to add or enable the connector first. Refresh the tool list after changing connections or permissions.

For current Claude navigation and availability, see Anthropic's remote MCP connector guide.

Connect to ChatGPT

Use an available BEON PASS app or plugin entry, or configure a custom MCP app where your ChatGPT account permits it. This documentation does not imply a public marketplace listing has been approved.

1. Open ChatGPT's apps or plugins settings. If using a custom app, use the developer-mode or workspace app-creation flow available to your account.
2. Set the remote MCP server URL to https://beonpass.com/mcp and use OAuth authentication.
3. Connect and sign in to BEON PASS with the account that owns, or has access to, the intended connections.
4. Review the authorization request, finish connecting, and enable BEON PASS in your conversation.
5. Ask for your profile and connected accounts. Refresh the app's tools after adding providers or changing access.

Custom-app creation, write tools, and workspace publishing depend on OpenAI's plan and administrator settings. Follow your client's confirmation prompts when performing actions.

See OpenAI's developer mode and MCP apps guide for current setup requirements.

Other MCP clients & developers

Use a client that supports a remote HTTP MCP server and the server's OAuth authorization flow. Do not put a provider API key in the MCP URL or paste provider tokens into an AI conversation.

Remote MCP endpoint

https://beonpass.com/mcp

Protected-resource metadata

https://beonpass.com/.well-known/oauth-protected-resource/mcp

Authentication

OAuth bearer authentication; use the authorization server advertised by protected-resource discovery.

Identity scopes advertised

openid, email, profile. Provider permissions are managed separately.

Discovery and account selection

Initialize the MCP connection, then use tools/list and the returned schemas. Tool names, descriptions, input schemas, and annotations describe the available operations. Discover tools again after a connection or permission change; do not assume every account sees the same inventory.

The server also exposes a resource for approval and secure-input interactions. Clients may support its embedded interface differently. Follow the supported secure page or component when an operation requests private input.

Tools can accept account or wallet selectors such as beon_connection_id and beon_context. BEON PASS management tools may use connection_id and organization_id. Always use the schema returned by discovery. Some clients adapt dots in tool names to underscores.

List my BEON PASS wallets and connections.
Use my personal wallet and the GitHub account labeled "Demo".
List its repositories. If that label is ambiguous, ask me to choose.

A browser visit to /mcp without an authorized client is not a connection test. This endpoint requires authentication and MCP requests.

Providers & capabilities

The integrations below have implemented tools. Actual availability depends on the connection, provider authorization, resource access, and your BEON PASS plan. This is a capability overview, not a promise that every provider API is exposed.

Provider	Examples of implemented capabilities
GitHub	Repositories, branches, files and commits; issues and comments; pull requests and reviews; releases; Actions workflows; environments, deployments, and secret metadata.
Supabase	Projects, branches, tables and SQL; migrations; Edge Functions; storage buckets and objects; selected authentication, database, network, and domain settings.
Vercel	Projects and deployments; build and runtime logs; domains and aliases; environment-variable management; Edge Config; deployment checks, routes, and rolling releases.
Cloudflare	Accounts, zones and DNS; Workers, versions and bindings; D1, KV, R2, Queues, Hyperdrive, and Vectorize; selected AI capabilities.
Railway	Workspaces, projects, services and environments; deployments and logs; domains; variables; volumes, backups, and recovery operations.
Expo	Account checks and dynamically discovered Expo tools, including available build, workflow, documentation, and app-store feedback operations.
Resend	Email and domain operations; contacts, segments, topics and broadcasts; delivery metadata; available webhook and API-key administration tools.

Read and write access are distinct. A tool being implemented does not authorize its use. Some actions need broader provider scopes, elevated organization permissions, or a secure private-input step. Secret-setting tools do not imply that secret values can be read back.

Verify before using

Show the capabilities available for my selected account.
List the test resources I can access, without changing anything.

Use only the providers offered in your wallet. Provider rollout and account eligibility can differ; a pre-existing connection may remain visible even when new connections are limited.

Multiple accounts

You can connect more than one account from the same provider. Each connection has its own identity, label, connection ID, status, and access configuration.

• Use Add account to connect another account. Give connections recognizable names such as “Work GitHub” and “Personal GitHub.”
• Use a connection's Account settings to manage its label, active status, and default selection.
• A default applies within the selected wallet. It does not resolve every ambiguity between wallets or accounts.
• Reconnect the specific connection that needs refreshed authorization. Choose the same provider account when reconnecting.
• Disconnecting or pausing one connection should be done from that connection's controls; check its label first.

Use the organization wallet "Example Team" and its GitHub
connection "Website". List open pull requests for the test repository.
Do not use my personal GitHub connection.

When more than one connection fits a request, identify the wallet and account explicitly. An AI's account-selection label is not a substitute for BEON PASS's server-side checks.

Personal & organization wallets

A personal wallet contains your personal connections. An organization wallet contains connections and access managed for an organization. Switching context changes which wallet a request targets; it does not move connections or grant additional privileges.

For individuals

Use Tools to manage connections, AI Access to manage AI access, Activity to inspect operations where available, and Billing to manage your plan. My access helps you inspect access shared with you.

For administrators

1. Create or select an organization.
2. Invite people and assign the appropriate role. The invited person signs in with the invited email and accepts the invitation.
3. Connect the organization's provider accounts and configure access for people, groups, and AI principals.
4. Select capabilities and resources; review temporary and standing access separately.
5. Use organization Activity to inspect operations and access changes.

Organization roles, membership, connection permissions, and AI access all matter. An AI principal or a named agent does not become an organization owner merely because the person using it is an owner.

Permissions & resources

Access is enforced against the selected connection and wallet. Provider authorization sets an outer boundary; BEON PASS permissions further control what a person or AI may do.

Organization access controls include subjects such as people, groups, roles, and AI principals; allow or deny rules; capabilities; connection boundaries; resource restrictions; and time bounds. Use the narrowest rule that fits the task.

Select resources by name

Where supported, use the resource picker to select recognizable repositories, projects, environments, zones, Workers, or other provider resources. An Advanced fallback is available for exact identifiers. Resource choices and supported boundaries vary by provider and operation.

Example policy: Give a teammate read access to one test project, then grant a separately scoped write permission only when needed. A permission on one connection does not automatically apply to another account from the same provider.

Inspect the resulting access through My access and the organization's access controls. If an operation is denied, ask the relevant administrator for the specific missing access rather than switching accounts to get around the restriction.

Requests, approvals & temporary access

If required access is missing, an operation can return an access or authorization request instead of executing. Requests identify the intended connection, capability or action, resources, and requested duration.

1. Request the smallest access needed and give a clear reason.
2. The designated approver reviews the request and its scope.
3. Only an approved, currently valid grant permits the operation. A pending request does not.
4. Retry the intended action after approval. Expired, revoked, or out-of-scope access does not apply.

Different kinds of approval

• Provider authorization: The account owner authorizes BEON PASS at the provider. Additional provider scopes may require reconnecting or another authorization step.
• BEON PASS access approval: An authorized approver grants access within the configured organization policy.
• Client confirmation: Native AI clients apply their own confirmation settings for supported actions. BEON PASS continues to enforce account and resource permissions.
• Exact-action or private-input flow: Some operations return a dedicated BEON PASS approval or secure-input interaction.

Do not assume that every write produces a separate BEON PASS confirmation screen. Client-managed authorization is not proof that a person manually confirmed each individual action.

Autopilot & authorization

Autopilot provides standing authorization for a defined scope. Personal grants are associated with an AI client and connection; organization standing access operates within the effective permissions of the human and AI.

A grant can identify permitted tools, resources, duration, and whether specified high-impact operations are included. Personal duration options include session-bound access, finite periods, and access until revoked. Availability depends on the plan and the grant type.

• Review the exact account and resources before enabling a grant.
• Choose a limited duration when ongoing access is unnecessary.
• Exclude high-impact operations unless they are specifically needed.
• Inspect Activity and revoke grants when the task is complete.

Autopilot does not override provider scopes, organization restrictions, expired access, or client-side confirmation policies. Operations requiring private values still use a secure input flow.

Show my active Autopilot grants for this client.
Explain each grant's account, tools, resources, and expiry.
Do not create or change any grants.

Security & account recovery

Sign-in and OAuth

Regular BEON PASS sign-in supports passkeys and email-link fallback. Passkeys use your device or authenticator's verification. Security-sensitive dashboard operations may require a fresh passkey or supported email verification. Manage passkeys and recovery codes from Passkeys & recovery.

Store recovery codes somewhere private. They are single-use recovery material, not credentials to share with an AI assistant or support. A separately provisioned review account may use a dedicated sign-in flow; this does not change regular user authentication.

Credential handling

Provider credentials are encrypted before database storage and decrypted server-side when needed to call a provider. They are not returned as connection credentials to the AI client. Secure private-input flows are used for supported operations that need secret values.

This is not end-to-end encryption of provider operations: BEON PASS must use the credential server-side to perform the authorized request. Tool results can contain provider data, which is sent to the AI client you authorized. Connect only accounts and clients you trust.

Revoking access

Manage or revoke AI authorizations in AI Access, revoke standing grants, and pause or disconnect provider connections in your wallet. Also review the provider's own integration or token settings when provider-side revocation is needed. Disconnecting a client in its settings and revoking provider authorization address different layers of access.

Do not paste passwords, API keys, tokens, recovery codes, or verification codes into chat or support messages. Review AI-generated changes and the provider's resulting state.

Activity & review walkthrough

Personal and organization Activity views expose operation details where available: account, client or AI, action, resource, status, timestamp, and authorization used. Safe requested, before, and after details may appear when the operation provides them. Not every provider operation can supply a full before-and-after comparison.

Reads, writes, blocked requests, failures, and standing-authorization activity are recorded through the applicable paths. Access to detailed views depends on plan and permissions. Sensitive values are redacted; do not rely on Activity as a place to retrieve secrets.

A reviewer-friendly walkthrough

1. Sign in with the account provided for your review, or a test account you control.
2. List the profile, wallets, and connections without exposing credentials.
3. Select an explicit test connection and perform a read-only operation.
4. Perform one authorized, reversible write against a disposable test resource—for example, create an issue in a test repository.
5. Inspect Activity. Demonstrate that a restricted operation requests access or fails without executing.
6. Remove the test resource if appropriate and revoke any temporary access created for the demonstration.

Use independently authorized demo resources. Review access does not automatically include the operator's personal or production provider accounts. Marketplace listing status is separate from this server's availability.

Troubleshooting

No tools, or fewer tools than expected

Confirm you signed in to the correct BEON PASS account, selected the correct wallet, and have active connections. Check provider scopes, organization access, and plan status. Refresh or reconnect the AI client's tool discovery. Tool counts can differ by account.

Free supports three active personal accounts

Pause another personal connection in Account settings or upgrade in Billing. Start the provider connection flow again after resolving the limit; do not repeatedly refresh an OAuth callback URL.

Reconnect required or authorization expired

Reconnect that specific account in Tools. Choose the same provider account and complete any provider verification. Return to the wallet, confirm its status, and refresh the AI client's tools.

A GitHub App is private or cannot be installed

The app must allow installation by your account, and your organization may require an owner to approve it. Contact support with the message shown; do not share the callback URL or authorization code.

Permission denied, access required, or approval pending

Check the exact connection, wallet, capability, resource, and grant expiry. An authorized organization approver may need to grant access. A pending request has not enabled the operation.

Request origin is not allowed

Open a fresh page at https://beonpass.com and repeat the operation from there. Avoid an old callback URL or another hostname. If it continues, send support the page path and time without query parameters or secrets.

Passkey unavailable

Use the email fallback or your configured recovery option. Check that the passkey is available on your device or password manager. Never share a recovery code or sign-in link.

Provider error or uncertain write result

Inspect the provider and Activity before repeating a write. Some provider actions can succeed even if a response is interrupted. Check provider quotas, billing, scopes, and availability.

Secure component does not display

Client support for embedded MCP interfaces varies. Use the secure fallback link when offered. Do not move secret input into chat.

For help, email info@beonlimited.com. Include the provider, safe account label, operation, approximate time, and redacted error. Exclude credentials, authorization codes, and secret-bearing URLs.

Frequently asked questions

Do I need a separate provider account?

Yes. BEON PASS connects accounts you own or are authorized to use; it does not replace a provider subscription or supply that provider's infrastructure.

Does it work with every AI client?

No. A client must support the relevant remote MCP transport, OAuth flow, and tools. Embedded interfaces, write confirmations, and available features vary by client and plan.

Why do two people see different tool counts?

Discovery depends on connected providers, account state, shared access, scopes, and dynamically available provider tools. A fixed tool count is not a compatibility requirement.

Can I connect the same provider more than once?

Yes. Use distinct connection labels and specify the wallet and account in your request. Limits apply to active accounts according to your plan.

Does Autopilot mean unrestricted access?

No. Its grant has a defined scope and remains subject to access checks, provider authorization, and client controls.

Does disconnecting BEON PASS delete my provider resources?

Disconnecting a wallet connection is separate from deleting provider projects or data. Review the provider's own authorization settings if you also want to revoke its token or integration.

Can using a tool cost money?

Yes. A provider operation can incur its own charges, such as creating infrastructure or sending email. These are separate from your BEON PASS plan.

Where are the policies and support details?

See Legal, Privacy, Terms, and Support. Contact info@beonlimited.com for help.

Documentation describes the deployed features checked above. The controls and tool schemas available to your account are the source of truth for each operation.