> ## Documentation Index
> Fetch the complete documentation index at: https://docs.withmethod.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> Identity, tenant scope, what the MCP never returns, and URL safety.

## Identity and tenancy

Dashboard users sign in with WorkOS and receive a session cookie.
MCP clients use WorkOS OAuth and send a bearer access token.
The API verifies the token against the WorkOS issuer and the Method audience.

Every method, file, build, version, artifact, and run result belongs to one organization.
Every query is scoped to the signed-in organization. No route or tool reads across organizations.

## What the MCP never returns

* Free-form API error text. Known codes map to fixed safe messages.
* Build checkpoints, evidence ledgers, or raw model output.
* Another organization's methods.
* A `.method` file or prompt whose SHA-256 does not match. A mismatch is an error, not a fallback.

The MCP holds no compiler, database, object store, or model of its own. It forwards the user's access token to the API.

## Credentials

The method file must contain no credentials. Supply credentials through the local host and its configured tools.
Your executor holds the credentials for the resources it uses.
Never put a password, token, cookie, or secret reference in a prompt, a supporting file, a `desired_outcome`, or a run result.

## Upload and download links

An upload link authorizes one upload of one recording for 24 hours. The token is in the URL fragment.
Do not put upload links or signed file URLs in logs, analytics, previews, or long-term storage.

## URL safety rules

The MCP downloads a remote file only when all of these hold:

* the URL uses HTTPS on port 443;
* the URL has no username, password, or fragment;
* the host is a public DNS name, not `localhost`, `.local`, `.internal`, `.home`, or an IP literal;
* every resolved address is a public unicast address;
* at most 3 redirects occur, and each target passes the same checks;
* the download completes within 120 seconds and never idles for 30 seconds;
* the content type is in the declared family or is an octet stream;
* the byte count matches `Content-Length` when present and stays within the limit for the file kind;
* the SHA-256 matches when you give one.

The bytes are staged in a private temporary file and removed after the upload.

## Verifiers

Every verifier is read-only and answers `pass`, `fail`, or `ambiguous`.
A `workflow_script` verifier runs in a sandbox with no network and no file system.