Protocols and contracts

Briefs uses the Model Context Protocol (MCP) to expose authenticated tools to assistants. MCP is the connection layer: it lets a client discover and call tools such as items_create and items_list_activities.

MCP does not define the Briefs work model. The meaning of an Item, Actor, or Activity belongs to Briefs and is shared by MCP tools, the REST API, Daily, and custom clients.

ActivityPub was an important reference point for Briefs' model: it demonstrates how a protocol can represent actors, durable objects, and activities as structured data that clients and services can act on.

Briefs is not an ActivityPub implementation. It does not expose ActivityPub inboxes or outboxes, use the ActivityStreams vocabulary as its schema contract, or provide server-to-server federation. The Item, Actor, and Activity schemas are Briefs-owned contracts designed for authenticated assistant workflows and application clients.

Production access uses OAuth bearer tokens. Daily uses the authorization code flow with PKCE, and the System API validates the token before resolving the request to a user and actor.

Briefs also supports email OTP through its OAuth issuer. The allowed-email policy is configured by the deployment; the client should treat the issuer as the authority for sign-in and identity.

The Item, Actor, and Activity schemas are Briefs-owned contracts. They are implemented with Zod in @briefs/shared and validated at the API boundary.

Start with the @briefs/shared exports when building a client. That keeps your UI and integrations aligned with the same contracts used by the System API.