---
credentials:
  mcp_bearer:
    description: "Bearer an MCP client must present to this role's adapter instance. Distinct from the upstream credential the adapter presents, because authenticating
      to the application says nothing about who called the adapter."
    algorithm: alphanumeric
    validation: "^[A-Za-z0-9]{32,}$"
    length: 48
  mcp_upstream_token:
    description: "Read-scoped API token the MCP adapter presents to this application. Separate from mcp_bearer, which guards the adapter itself: one says who may
      call the adapter, the other what the adapter may read."
    algorithm: alphanumeric
    validation: "^[A-Za-z0-9]{32,}$"
    length: 48