MCP authentication

How authentication works when connecting your editor to the Buron MCP server, and how to handle CI and headless environments.

When your editor connects to the Buron MCP server for the first time, it opens your browser to sign in. You log in with your Buron account, pick your organization if you have more than one, and approve the connection. Your editor handles the rest: no tokens to copy, no config to edit.

The session lasts until it expires. When it does, your editor opens the browser again. Most editors handle the refresh silently.

What's scoped to what

Every MCP request is scoped to a team. The team ID is part of the server URL:

https://app.buron.ai/api/mcp?teamId=tm_abc123

All data you see through the MCP server, including queries, dashboards, knowledge files, and integrations, belongs to that team.

Multiple teams

If you're on more than one team, each team has its own MCP server URL. buron setup configures the URL for whichever team you link to during setup.

To work with a different team in the same project, re-link first:

buron link        # pick the other team
buron setup       # re-run to update the MCP URL

To connect to multiple teams at the same time, add a second MCP server entry in your editor's config. In Claude Code, that's .claude/settings.local.json:

{
  "mcpServers": {
    "buron": {
      "type": "streamable-http",
      "url": "https://app.buron.ai/api/mcp?teamId=tm_abc123"
    },
    "buron-other-team": {
      "type": "streamable-http",
      "url": "https://app.buron.ai/api/mcp?teamId=tm_def456"
    }
  }
}

You can find each team's MCP URL on the Settings page in Buron. Switch teams from the sidebar, then copy the URL.

CI and headless environments

In CI pipelines and other environments where there's no browser, use the Buron CLI with a BURON_TOKEN instead of the MCP server. The CLI authenticates with the token directly:

export BURON_TOKEN="brn_..."
buron file read /wiki/company.md

Create a CI token from Settings > API tokens in Buron. See Run Buron from CI for the full setup.

Treat CI tokens like passwords. Add them as secrets in your CI provider, never paste them into code or logs.

Revoking access

To disconnect an MCP client, revoke its session from Settings in Buron. The next time the editor tries to connect, it'll prompt for sign-in again.

To rotate your CI token, delete the old one in Settings > API tokens and create a new one. Update the secret in your CI provider.

Troubleshooting

"Missing authorization token" error. Your editor didn't complete the sign-in flow. Restart the editor and try again. It should open the browser for sign-in.

"teamId is required" error. The MCP server URL is missing the ?teamId= parameter. Copy the full URL from Settings in Buron, or re-run buron setup.

Sign-in loop. If your browser keeps opening, your session may have expired or been revoked. Clear your editor's MCP credential cache and sign in fresh. In Claude Code, run /mcp to see server status and reconnect.