# Authenticating an agent with NomadPoint

NomadPoint has two agent surfaces, and only one of them needs credentials.

## No auth: the WebMCP tool

On any page of https://nomadpoint.app, a browser agent with WebMCP can call
`calculate_schengen_days`. It runs in the page, needs no account, and uploads nothing.

## Personal access token: the MCP server

The NomadPoint MCP server reads and edits one user's own trips. It does not use OAuth. Each user
issues one personal access token for their agent.

1. The user opens the NomadPoint iOS app and goes to Settings > Claude / MCP. This is a Pro feature.
2. They tap Connect Claude, then Copy prompt. The prompt carries the server URL and a token of the
   form `np_mcp_<hex>`, and configures Claude with both when pasted into it.
3. The agent connects to `https://nomadpoint.app/mcp` over
   streamable HTTP and sends `Authorization: Bearer np_mcp_<hex>` on every request.
4. Every tool call is scoped to that user's trips: journeys they own, plus shared journeys they
   have accepted. The server stores only a SHA-256 hash of the token.
5. To revoke access, the user taps Disconnect on the same screen; the token stops working
   immediately. Regenerate Token replaces it, and the old token stops working.

A request with a missing or unknown token is rejected. Agents should not ask users to paste their
Apple ID or NomadPoint password; the token is the only credential an agent needs.

Registry entry: `app.nomadpoint/nomadpoint` on registry.modelcontextprotocol.io. Setup guide for
agents: https://github.com/eladkishon/nomadpoint-skills