> For the complete documentation index, see [llms.txt](https://dsg-3.gitbook.io/dsg-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://dsg-3.gitbook.io/dsg-docs/cinema-proof-agent/runtime-and-integrations/agent-pairing-and-remote-mcp.md).

# Agent Pairing and Remote MCP

Short-lived Agent credentials, durable encrypted pairing records, revocation, and the paired-agent MCP surface.

Cinema keeps the customer master DSG API key on the browser/server side and gives the Agent a short-lived pairing credential instead.

## Pairing record

```
pairing token
    │
    ├─ plaintext returned once
    │
    └─ SHA-256(token) persisted
             │
             └─ durable record
                    ├─ account / agent / expiry
                    ├─ claimed_at
                    └─ AES-GCM encrypted DSG API key
```

Security properties implemented by the current runtime:

* plaintext pairing token is not persisted;
* only the token digest identifies the durable record;
* the master DSG API key is encrypted before persistence;
* records live on shared durable Remote Action storage;
* another production replica can resolve the same valid token;
* expiry and revocation are checked every time;
* first successful resolution records durable `claimed_at` state;
* the model/tool payload never needs the master credential.

## Dedicated production pairing key

Production uses `DSG_AGENT_PAIRING_KEY` as the dedicated pairing-encryption path. It is independent from the ordinary per-deployment Cinema application secret.

The production rolling-revision proof on 3 September 2026 showed that a token issued before a real new Container Apps revision remained valid afterward when the dedicated key remained stable.

## Remote MCP

Paired-Agent execution surface:

`POST https://dsg-cinema-production.nicetree-a005fe99.westus3.azurecontainerapps.io/mcp`

This is JSON-RPC over `POST`. A plain `GET /mcp` is not the protocol test.

Core tool families include:

* `remote_contract`
* `remote_status`
* `remote_agent_connect`
* `remote_action`
* `remote_disconnect`
* dashboard chat tools
* Universal Runtime tools

A paired credential authenticates the Agent-facing connection. It does not grant authority outside an approved plan.