# Feature AI-41 - Allow authentication to MCP endpoint via session cookie

Project: Stream AI
Status: closed
URL: https://community.openproject.org/work_packages/AI-41

## Planning

| Attribute | Value |
| --- | --- |
| Date | 2025-11-14 – 2026-03-31 |
| Priority | Medium |
| Target versions | 17.2.0 |
| List |  |
| Roadmap |  |
| Relevance |  |

## OPEN POINTS / FEEDBACK

_No work packages_

## Features and Chunks

_No work packages_

## Bugs and other work packages

_No work packages_

## Technical Details

| Attribute | Value |
| --- | --- |
| Module |  |
| Feature Flag |  |
| Requires doc change | No |
| Enterprise plan |  |

## Details

| Attribute | Value |
| --- | --- |
| Pull preview |  |
| Mockups |  |

## People

| Attribute | Value |
| --- | --- |
| Assignee |  |
| Accountable |  |
| Product manager |  |
| Developers | Jan Sandbrink |
| Designer |  |
| Ordered by |  |
| Signed off by |  |
| Interest by |  |

## Estimates and progress

| Attribute | Value |
| --- | --- |
| Work |  |
| Labor costs |  |

## Description

**As** a plugin develop,  
**I want to** authenticate against MCP endpoints via Session auth,  
**so that** I can implement JavaScript MCP clients that act in the context of the current user.

**Acceptance criteria**

*   Allow authentication to MCP endpoints via Session auth
    

**Technical assessment**

*   This should not bear a lot of technical complexity to enable
    
*   The risk of privilege escalation through this is pretty low, since MCP allows fewer things than APIv3, which already allows session auth