Connected Assistants
Workspace Assistant MCP
User-facing, workspace-scoped, read-only context.- Summaries, recent changes, daily review, and readiness checks
- Lead follow-up reasons with safe handles and status context
- Public source blockers and recommended review actions
Internal Ops MCP
Founder/admin tooling for local development and operations.- Not a customer integration surface
- No user assistant token should grant internal ops access
- Kept separate from workspace assistant setup and docs
Scoped Assistant Token Model
Credentials are tied to one user, one workspace, explicit read scopes, and a revocation lifecycle.Token record
User id
Workspace id
Allowed scopes
Expiration
Created by
Last used at
Revoked at
Allowed read scopes
workspace.summary:read
workspace.activity:read
workspace.followups:read
workspace.sources:read
workspace.brief:read
workspace.ask:read
Never allowed through assistant tokens
CRM writes
Internal inspector access
Tester grants
Billing changes
Provider calls
Raw database queries
Cross-workspace reads
Create Assistant Token
Workspace owners and admins can create scoped read-only tokens for local assistant clients.Active Assistant Tokens
Raw token values are never shown after creation. Revoke a token if a client should lose access.Current local setup
Today, the workspace connector runs locally and calls the authenticated read-only workspace context routes using `ORBI_WORKSPACE_ASSISTANT_TOKEN`.
npm run workspace:confignpm run workspace:mcpnpm run workspace:smokeNext backend slice
- Add assistant-token rotation
- Add client-specific setup snippets for ChatGPT, Codex, and Claude Code
- Add authenticated Google-backed smoke evidence with an owner-approved token
- Package a scoped ChatGPT connector manifest when the platform path is ready