​

Tokens

Bearer tokens authenticate external requests to the MCP server. Each token carries a scope, an optional connection allowlist, and an optional expiry. TablePro stores only the SHA-256 hash plus a per-token salt at ~/Library/Application Support/TablePro/mcp-tokens.json with 0600 permissions. The plaintext is shown once at creation and never again.

​

Require authentication

Settings > Integrations > Authentication > Require authentication is on by default. With the toggle off, requests from your own machine (loopback) are accepted without any token and run with full scopes and access to all connections. Remote clients need a bearer token regardless of the toggle. Turning it on for the first time with no tokens yet mints a full-access “Default token” and reveals the plaintext once.

​

Stored fields

The plaintext format is tp_ followed by 32 base64url-encoded random bytes.

​

Scopes

A token’s permissions value maps to the MCP scopes the server enforces: What each token can do: Navigation tools (open_connection_window, open_table_tab, focus_query_tab, list_recent_tabs) need only tools:read. They surface UI but never bypass the connection allowlist or externalAccess: blocked. DROP and TRUNCATE always require an explicit confirmation phrase via confirm_destructive_operation, plus a token with tools:write. No token permission bypasses the phrase.

​

Connection allowlist

Each token grants access to all connections or a limited set. A request that targets a connection outside the allowlist returns 403 Forbidden before any per-connection check runs.

​

External access combination

The effective permission is MIN(token.scope, connection.externalAccess). A token’s reach is bounded by both itself and the connection’s externalAccess.

​

The stdio bridge token

Every MCP server start mints a fullAccess token named __stdio_bridge__ and writes its plaintext to the handshake file for the bundled stdio bridge. It is hidden from the Settings token list, deleted when the server stops, and stale copies are removed the next time the store loads. Its name can appear in the activity log. To give an AI agent less than full access, skip the bridge and connect over HTTP with a scoped token.

​

Creation

1. Pairing flow (most common). See Pairing. Approving a pairing request first revokes any active token with the same client name.
2. Settings UI: Settings > Integrations > Authentication > Generate Token. Pick name, scope, allowlist, and expiry. The plaintext is shown once in a reveal sheet.

​

Expiry

Optional. An expired token stops authenticating and requests return 401 Unauthorized. Prefer short expiries for anything with write access.

​

Revocation

Settings > Integrations > Authentication lists all tokens with prefix, name, scope, allowlist, last-used time, and expiry. Each row has:

• Revoke: marks the token inactive. It stays in the list and cannot be reactivated.
• Delete: removes the row entirely.

A revoked token returns 401 Unauthorized and the server terminates its active sessions immediately. The extension shows an unauthorized state on its next call; run the pairing command again to mint a new token.

​

Audit log

Every authentication, tool call, and resource read is recorded in ~/Library/Application Support/TablePro/mcp-audit.db with the token id, never the plaintext. View it via Settings > Integrations > View Activity: Entries older than 90 days are pruned when the audit store opens.

​

Rate limits

The authenticator throttles failed token attempts. The bucket key is (client_address, principal_fingerprint), so a misbehaving bridge cannot lock out other principals on the same loopback address. A successful auth clears the bucket. During lockout the server returns HTTP 429 Too Many Requests.

​

What tokens cannot do

The token surface is the MCP tool catalog, resources, and the URL scheme. Anything not on those lists is not reachable.