Compact account and MCP prototype

Status: design proposal, not a replacement for live authentication. Current artifact: interactive prototype, with styles and behavior. The six original SVG files in this directory are superseded v1 illustrations and are not the current specification.

What changed and why

The previous illustrated wizard had large headings, low information density and no persistent account identity. It made the user reconstruct who was signed in, which profile owned a connection and whether setup repeats. The revised prototype is a native compact application shell: 14px body, 28px maximum page heading, 36px controls, 472px contextual dialogs, 8-row object table, persistent account menu and separate profile selector. Dark purple surfaces follow the existing marketplace; there is no new large sidebar or hero.

The account is Alex Lee / alex@example.com (fictional). Personal and Work are private contexts inside that account, not separate identities. A connection belongs to one profile; a session authenticates the account; a grant permits a named MCP to use a connection for specified operations and duration. Account-level Authenticator enrollment is performed once.

Core connection journey

1. #account: account identity, account-wide security, active profile, connection status and last used, Open and Manage, and tools requiring no provider credential. Profile selection clears the former profile's view. Empty sample profile has an explicit Add connection path.
2. #detail: connector purpose, availability, read-only scope and an 8-row fictional example table. Returning authenticated users with a connection choose Open workspace directly. First-time, returning and already-enrolled sample paths are available below the table.
3. #google: compact modal preserving S3 selection. Proposed Google sign-in is explicitly marked nonfunctional. No actual provider redirect, account or session is created.
4. #mfa: one-time enrollment placeholder for a new account; verification-only for an existing enrollment. No functioning QR or OTP field. After a session expires, successful sample verification returns to existing results, not a new credential form.
5. #token: scoped S3 key-pair connection, name, reviewed provider/destination, region, bucket, allowed operations, profile, grant duration and fresh action-bound OTP. The first operation tests a selected bucket; account-wide bucket listing is not a prerequisite. Secret form fields are disabled and contain no live data.
6. #results: actual product's intended result layout, but all prototype rows remain explicitly fictional. Sample refresh, metadata details, upstream error and expired-session paths work locally.

Use the screen selector to inspect states directly. Main navigation, account menu, profile selector, dialogs, cancellation, object metadata and sample action buttons are native semantic HTML. There is no networking or persistence. Secret and file inputs are disabled; search and text examples accept local-only input. The review selector prepares sample prerequisites for its selected screen; ordinary navigation preserves the current profile state. Escape closes a dialog; native modal focus trapping applies. Buttons and selects have visible keyboard focus.

Secret management contract

Account overview displays only safe connection labels/status, not versions or grants. Manage first requests fresh Authenticator confirmation for that connection and action. Authorized metadata then shows a sample version, scope, grant expiry and last test. Replace credentials and Revoke grant each request a separate fresh confirmation. Revoking a Hub grant does not revoke a provider key externally. No reveal or export exists.

Production must enforce identity, profile, connection, target, operation, expiry, credential version and one-use challenge server-side. A previous code cannot approve an unrelated action. Human secret metadata access is also step-up protected. Background MCP calls use the previously approved finite grant and do not prompt for a new OTP on each request.

A remembered device is not a recovery authority. Factor replacement and account recovery remain an explicit product/security design dependency; the prototype does not imply a working recovery bypass.

Errors and return paths

• Invalid action code: nothing saved; retain nonsensitive connection details, request a fresh code.
• Secret service unavailable: nothing saved; retry safely when available.
• Save succeeded, provider test failed: connection remains saved; retry provider test, not create a duplicate connection or reimport credentials.
• Provider unavailable after success: show previous data with an explicit stale label; preserve the connection.
• Expired session: preserve selected tool, then sign in and verify the existing factor; open the saved connection directly.
• Cancel: close context panel and retain the surrounding tool. In production erase any typed secret on cancellation.

Acceptance and current limits

Inspect at 1100 × 720 and at narrow viewport. Account identity and profile must be distinguishable at a glance; connection Open must not ask for the provider key again; Manage cannot expose secret metadata before step-up; enrollment and later verification must be distinct. Check keyboard navigation, Escape, focus return, every sample-state action and zero network requests. Prototype rendering alone does not establish usability improvement; compare first-use completion and returning-use success with the former flow in a user walkthrough.

The six original SVGs are intentionally retained as historical evidence only. Screenshots of the current native prototype, when rendered, are the current visual deliverable. Google sign-in, recovery and generic connectors remain proposals; existing live Hub passkey authentication is unchanged by these files.

Expanded review coverage

The current version expands the approved compact shell to 17 linked native review pages. All Google/MFA/secret/upload actions remain nonfunctional samples. Text counting and catalog/object filtering operate only on local page data. The catalog is a representative subset, not a duplicate live inventory. No source-only entry gains a runnable action.

Revoking a grant preserves its saved connection with Access revoked. Deleting a connection removes the stored connection/grants from this profile; neither action claims to revoke the provider credential externally. Regrant and deletion each have their own fresh action-specific confirmation. Viewing object metadata is a data operation, distinct from step-up protected secret metadata.

Profile switches clear the active file/job view; stored sample job records remain scoped to their own profile. The reviewer scene selector can seed a fictional job for inspecting a specific frame; ordinary history opens only a record belonging to the selected profile. Simulation controls are visually separated from production navigation.

Out of scope: billing, admin console and public deployment of custom MCPs. Recovery is a release blocker, not a reset shortcut. No fake functional navigation to those features is included.