Skip to main content

​
Your account, your permissions

MCP authenticates to Bench with your account or a scoped Bench API key. A client cannot use MCP to bypass repository access, tenant isolation, key limits, or evaluation quotas. Prefer hosted sign-in when your client supports it. For a local server or automation, create a key on the MCP page in Bench. Keys are shown once. Keep them in personal client configuration or a secret manager, not in a repository, prompt, screenshot, or chat.

​
Local environments

Use the BENCH_API_BASE_URL supplied by the environment that created your key. A local key will not authenticate against the production API. Do not copy production credentials into a test account.

​
Actions with consequences

Ask your coding agent to get confirmation before spending evaluations or creating pull requests. A reviewable candidate is not an applied, deployed, or independently validated fix.

​
Context and trustworthy results

Business rules define intended behavior. Traces describe observed behavior; they are not automatically correct. Feedback on a single case must not silently become a rule for every case. Saved evaluations retain their context and artifact references. New information informs a future bench, not a silent rewrite of historical scores. Unknown or unscored checks should remain visible and must not be treated as passed tests.

​
Revoke a connection

Revoke API keys in MCP → Manage keys and permissions. Remove the MCP entry from clients that no longer need access. If a key appears in a chat, screenshot, or repository, revoke it and issue a replacement.