MCP

The desktop client carries an MCP server. MCP — the Model Context Protocol — is how an AI assistant is given tools. Point an assistant at this server and it can show your identity code, confirm three words someone has just read to you, set up connections, and stamp text, without you leaving the conversation.

It runs on your machine. It is a subcommand of the same tcc binary the desktop window and the command line use, and it works against the same account, the same keys and the same local data. There is no separate service to sign up for.

tcc mcp configure

What an Assistant Can Do

The server exposes 31 tools. Most of them are the desktop client’s own work, made callable:

Codes. Your current three words, the current code for one connection, every connection’s code at once, and when they next rotate. It can also compute your code for a moment in the future, so an assistant that can read your calendar can tell you the words for your two o’clock meeting.

Confirming somebody. Someone reads you three words; the assistant checks them against your connections and answers match or no match. It can also ask the server about words that belong to nobody you know — a beacon, a provider stamp, a stranger.

Connections. Invite people, list them, tag them, rename them, manage members and shareable links, and issue guest codes for people who do not have Trusted Codes.

Stamping. Put your identity on a piece of text, optionally binding a file’s hash to it, and get back a verification link.

Account and organisation. Email addresses, devices and open sessions, data exports, notification settings, API tokens, and — for admins — org members, groups, alerts and usage.

The tools reference lists each one.

What It Deliberately Cannot Do

Some things are missing from the tool list on purpose, and the reasons are worth reading before you wire an assistant up.

It cannot delete your account. Deletion is irreversible and total. A re-prompt for your email address stops an accident, but it does not stop a model — the model can read that address from the profile tool one call earlier. Account deletion is a terminal command, typed by a person.

It cannot transfer or reassign an organisation. Same reasoning: it moves a whole organisation between people.

It cannot send feedback to the team. An agent has no feedback to give, and a wrong call costs a person’s attention.

It cannot mint a provider stamp over the network. That tool signs with the key held on that one machine. It is reachable from an assistant running on the same computer, and refused outright over the daemon’s network port.

It cannot become a middleman. The server does not route your assistant to a second assistant on the Trusted Codes side.

There is a further boundary that is not about tools at all. Trusted Codes confirms identity. It does not confirm intent, and a verified person can still make a fraudulent request. The instructions the server hands every assistant on connection say this plainly, and forbid the assistant from answering “is this transfer safe?”. The honest answer is that the identity checks out — nothing more.

The boundary page covers the rest: scopes, rate limits, the audit log, and the rules the server sets for how an assistant may talk about what it finds.