> ## Documentation Index
> Fetch the complete documentation index at: https://docs.junojourney.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security & permissions

> How the Juno MCP server authenticates, scopes access, and respects your Juno permissions.

export const RelatedPages = ({pages = []}) => {
  if (pages.length === 0) return null;
  return <>
      <br />
      <strong>Related articles</strong>
      <CardGroup cols={2}>
        {pages.map(page => <Card title={page.title} href={page.href} key={page.href} />)}
      </CardGroup>
    </>;
};

export const SupportContact = () => {
  return <Info title="Still need help?">
      Contact us at <a href="mailto:support@junojourney.com">support@junojourney.com</a> or use the support widget in Juno.
    </Info>;
};

<Info>
  The Juno MCP server is built for enterprise use: OAuth 2.1, no shared credentials, and access that never exceeds your existing Juno permissions.
</Info>

## Authentication

The server uses **OAuth 2.1** with dynamic client registration. When your assistant first connects, a browser window opens to sign in to your Juno workspace and authorize access. Juno issues a scoped, refreshable token to that client.

* No API keys or shared service accounts.
* The authorization consent screen shows the requesting application's name, so you know what you're connecting.
* You can revoke a connection at any time from your MCP client.

## Permission inheritance

Access is granted only to the data and actions your Juno role already permits. Connecting over MCP does **not** open up new categories of data — it makes the content and actions you already have easier to reach from an assistant.

* Everything is scoped to your workspace.
* Which capabilities are available depends on your plan and admin settings. Tools you aren't permitted to use simply don't appear to your assistant.
* If an admin enables a capability mid-session, reconnect the server for the new tools to appear.

## Admin controls

Authoring, program, and interactive-lesson capabilities are controlled by your Juno administrator. If a capability you expect isn't available, ask your admin to enable chat access for it — or use the same feature in the Juno web app.

## High-impact actions

Publishing, assigning, and notifying learners are high-impact actions — review them before you confirm. Drafts stay invisible to learners until you publish them.

<Warning>
  As with any AI tool connected to your data, review high-impact actions before confirming them, and only connect assistants you trust. Be mindful of prompt-injection risks when an assistant processes untrusted content.
</Warning>

<SupportContact />

<RelatedPages
  pages={[
{ href: "/mcp/overview", title: "MCP overview" },
{ href: "/mcp/troubleshooting", title: "Troubleshooting" }
]}
/>