Apps for your team

What an app for a team is, how it fits with Theorem, and what you build to make one.

An app is your team's own MCP server, on your own servers, that trusts a token Theorem signs. Once a leader adds its address to the team, the people it is for have it in their assistant. They need no second sign-in and no key, and you keep no password for them.

Use an app for what differs from team to team: attendance, orders, an ERP, a school's records.

How a call reaches your app

1. A person writes to their assistant. Theorem works out which of the team's apps they get, and lists each app's tools for the model.
2. When the model uses one of your tools, Theorem calls your MCP server at its address, over streamable HTTP, with Authorization: Bearer and a token made for that person and your app.
3. Your app checks the token, reads who the person is and the roles they hold in the team, and decides for itself what they may do.
4. Your answer goes back into the chat.

Theorem sends your app nothing else of the person's: no session, no chat, and nothing of their other teams.

What you build

• An MCP server that answers over streamable HTTP at an https:// address on the internet. Any MCP library will do.
• A token check on every request: Theorem's signature, its issuer, your app's ID as the audience, and that it has not ended. See The token.
• Tools with names, titles and annotations that say whether they only read. Theorem decides from the annotations whether the assistant asks the person first. See Tools.
• Your own rules for who may do what, from the team and roles in the token. See Roles in your app.

You need nothing from Theorem but the app's ID, which a leader copies from the Connections tab (Your team's connections), and Theorem's public keys at https://theorem.sa/api/identity/jwks.

Start from the example

Quick start runs a small attendance app in Python: three tools, the token check, and a rule by role. It is about a hundred lines.