TKEN

MCP host config

Review MCP host config before connecting a model gateway

Keep MCP server permissions separate from the OpenAI-compatible model route. Review server commands, local access, env vars, approval points, and redacted evidence before using TKEN in an IDE, desktop host, agent runner, or team workflow.

Get API key Run endpoint preflight
Separate the two configs MCP host + model gateway 
{
  "mcpServers": {
    "local-docs": {
      "command": "node",
      "args": ["./servers/docs-search.mjs"],
      "env": {
        "DOCS_ROOT": "./docs"
      }
    }
  },
  "modelProvider": {
    "baseURL": "https://www.tken.shop/v1",
    "apiKeyEnv": "TKEN_API_KEY"
  }
}
MCP servers define tools and permissions
Model config holds base URL and API key
Preflight /models before agent rollout

Two configs, two risk surfaces

MCP hosts connect models to tools. A safe review treats the MCP server as the tool boundary and the OpenAI-compatible base URL as the model boundary. Mixing them makes permission bugs, leaked keys, and rollout failures harder to debug.

MCP host config
Servers, commands, args, env, approvals
MCP server risk
Filesystem, network, write actions, secrets
Model gateway config
https://www.tken.shop/v1 plus API key env
Model route risk
Model ID, latency, quota, response shape
First proof
GET /models with redacted evidence
Rollout gate
One harmless tool plus one small chat

Review sequence

1. Inventory every MCP server

List each server name, command, arguments, working directory, environment variables, install source, update path, owner, and intended tool set before enabling it in a host.

2. Classify permissions before traffic

Mark read-only, write, network, browser, shell, filesystem, and external-account actions. Add explicit approval for actions that create, delete, send, purchase, deploy, or expose private data.

3. Configure the model route separately

Put the TKEN base URL in the OpenAI-compatible model provider section. Keep the API key in an environment variable such as TKEN_API_KEY, never inside an MCP server command or public config.

4. Preflight before real tools

Confirm /v1, /models, selected model ID, and one small non-streaming chat request before connecting real MCP tools or giving an agent access to local projects.

Evidence to keep

A useful rollout record proves what changed without preserving secrets. Keep operational facts, not sensitive screenshots or raw prompts.

Safe MCP evidence
Server name, command hash, permission class
Safe gateway evidence
Base URL, model count, selected model, latency
Safe failure evidence
Status code, timeout, failure class, redacted preview
Do not store
Keys, private prompts, order IDs, account screens
Approval evidence
Who approved writes, deploys, sends, purchases
Rollback evidence
Disabled server, reverted model config, owner alert

Host rollout gate

Read-only first

Start with one harmless read-only MCP tool and one small model request. Do not begin with shell, browser, billing, email, deployment, or destructive file actions.

Human approval for irreversible actions

Gate actions that send messages, publish content, spend money, change security settings, deploy production changes, or modify account data. Save only the approval outcome and redacted summary.

Stop on mismatched model behavior

If the chosen model ID is absent from /models, tool-call shape is unsupported, latency is unstable, or errors cannot be classified, pause the rollout and fix configuration before expanding access.

TKEN is an independent third-party OpenAI-compatible API gateway. It is not officially affiliated with OpenAI, Anthropic, the MCP project, MCP hosts, IDE vendors, or model providers. Model availability, pricing, context limits, streaming behavior, tool support, and rate limits can vary by account, channel, and provider status. Live /pricing remains the source of truth.

MCP host config FAQ

Is MCP server config the same as model gateway config?

No. MCP config tells a host which servers to connect to and what tools they expose. Model gateway config tells the client where to send model requests, which API key to use, and which model ID to select.

Where should I put the TKEN base URL?

Use https://www.tken.shop/v1 in the host's OpenAI-compatible model provider settings. Keep the API key in an environment variable such as TKEN_API_KEY and redact it from screenshots.

What should be reviewed before enabling an MCP server?

Review command, args, env, working directory, install source, filesystem access, network access, external accounts, write actions, user approvals, logging, and rollback steps.

Preflight the model route before enabling tools

Create a TKEN key, set https://www.tken.shop/v1 as the model base URL, confirm /models, then test one harmless MCP tool with redacted evidence.

Create account Developer hub