ZOREVA-UI

Legal/Trust & integrity

Trust & integrity

Last updated Oct 23, 2026

How to verify what you connect: the hosted MCP endpoint, the host playbook agents follow, and checksums for every published file. See also Security.

01Product path (recommended)

Connect the hosted MCP only. Your client starts a standard OAuth 2.1 sign-in (PKCE, dynamic client registration): you sign in to ZOREVA-UI, review the request and press Allow, and the client receives its token automatically. No Cursor or Claude skill install. Agent rules ship inside the MCP via get_host_playbook and the resource zoreva://host-playbook.

  1. Setup: /mcp → pick your client → add the server → sign in with ZOREVA-UI → Allow.
  2. Playbook (human-readable): /trust/HOST_PLAYBOOK.md

02Why we don’t push skill install

Unverified community skills trigger warnings in Cursor and Claude and often fail to install. ZOREVA-UI does not require a skill. Installing one is optional and unsupported on the setup page.

03MCP endpoint

  • MCP URL: https://zoreva-ui.com/api/mcp
  • Auth: OAuth 2.1 with PKCE. Discovery: protected resource and authorization server metadata. Access tokens last 1 hour and refresh automatically.
  • Fallback for clients without OAuth: a manual token from Account (7 days). No API keys to paste.
  • Integrity record: manifest.json

04Checksums

SHA-256 of the files published under /trust, from the manifest:

05Security model

  • The playbook and tool responses are the source of truth for agents.
  • The website, admin, Swift and billing monorepo is private and is not published for install.