AQPotency Building Block

TM
TJ Mustard
Updated June 2026 · BioSim Building Block · Q2 2026 Launch

Overview

AQPotency is SandboxAQ's ultrafast proteochemometric potency model (PCM) for small-molecule drug discovery. It takes a protein UniProt accession and a ligand SMILES string and returns a predicted potency (potency_mean, on the pIC₅₀ scale), an uncertainty estimate (potency_sigma), and applicability signals (ligand_similarity, protein_in_training) via an async job — no GPU, no per-target training, no docked pose or crystal structure required.

AQPotency is purpose-built for relative ranking — virtual screening, selectivity profiling, off-target and safety-panel scans, and reverse screening — not absolute potency prediction. It is the fast triage layer that runs before slower physics-based workflows such as docking, FEP, or experimental screening.

AQPotency is available via the SandboxAQ MCP Server — SandboxAQ's fully managed server, optimized for LLM and agentic integration with Anthropic and Microsoft Discovery partner surfaces.

What is AQPotency?

AQPotency is a BioSim Large Quantitative Model (LQM) Building Block — a modular, containerized scientific workflow that wraps SandboxAQ's proprietary PCM model into a small, callable set of MCP tools. Unlike target-specific ML models that require custom training and GPU infrastructure, AQPotency exposes a general, CPU-friendly potency engine in a single tool invocation.

AQPotency is well suited for answering questions like:

  • Which compounds should I prioritize for a given target?
  • Which proteins are the most likely targets of a phenotypic hit?
  • Which compounds appear selective for an on-target relative to a target family?
  • Which predictions are trustworthy enough to move downstream?

Through the SandboxAQ MCP Server, users can:

  • Score a single protein–ligand pair from a UniProt ID and a SMILES string via AqpotencyPotency (async — jobs typically finish in seconds).
  • Screen a SMILES library of up to 10,000 compounds against a single target with AqpotencyScreen, using an upload-session flow (upload_files / upload_local_files with purpose='aqpotency_screen').
  • Run a single ligand against curated panels — human_kinome, bowes_safety_panel, or proteome — via AqpotencyScan for off-target and toxicity triage.
  • Compute selectivity ratios with AqpotencySelectivity against one on-target and a list of off-targets, without standing up custom infrastructure.
  • Integrate AQPotency outputs directly into LLM-driven workflows via Claude, Microsoft Discovery, or other MCP clients.

Positioning — ranking, not absolute prediction: AQPotency typically delivers useful Spearman rank correlations but limited R² on absolute potency. Treat predictions as a fast ranking signal with uncertainty (potency_sigma), and rely on the always-on applicability signals — ligand_similarity and protein_in_training — to gate confidence.

How It Works

AQPotency is implemented in Model Forge and runs on CPU. Each tool call automatically orchestrates:

  1. Protein Embedding Lookup: UniProt IDs are mapped to pre-computed ESM2 protein language model embeddings stored in a cached lookup table. There is no runtime PLM cost.
  2. Ligand Featurization: Ligand SMILES strings are converted to fast small-molecule fingerprints on the fly.
  3. Potency Prediction: A Gaussian mixture model head fuses protein embedding and ligand fingerprint to predict potency_mean (on the pIC₅₀ scale) plus a per-pair potency_sigma (Gaussian-mixture standard deviation).
  4. Applicability Scoring: Two applicability-domain signals are computed automatically and returned with every prediction — ligand_similarity (max Tanimoto vs. the training set, 0–1) and protein_in_training (boolean). AD is always on; there is no opt-in flag and no separately callable AD tool.
  5. Result Delivery: All four tools are asynchronous. Each call returns a job_id in 1–2 seconds; results are retrieved by polling check_job_status and then calling get_job_results.

AqpotencyPotency jobs typically finish in seconds. AqpotencyScreen accepts up to 10,000 SMILES per request (with a 16 MB upload-file cap) and returns results as a JSON predictions list sorted by potency_mean descending.

Ranking signal, not absolute truth. Treat predictions as a fast ordering signal, not a quantitative affinity. Always inspect ligand_similarity, protein_in_training, and potency_sigma before acting — out-of-domain proteins or ligands yield lower rank correlation and often negative R².

Trust signals are always included. ligand_similarity and protein_in_training ride along with every prediction at no extra cost — no opt-in, no separate trust-stack tool to call.

Using AQPotency

LLM tool invocation is non-deterministic. Claude may occasionally answer an AQPotency-shaped question from its own knowledge rather than calling AqpotencyPotency, AqpotencyScreen, AqpotencyScan, or AqpotencySelectivity. Follow the setup and prompt-phrasing guidance below — and see Improving tool-invocation reliability for the full write-up (including how to disable lazy loading in Claude Desktop, which is the single biggest reliability win).

Typical Workflow

A typical AQPotency session through an MCP client follows the same four-step shape regardless of which tool you reach for:

  1. Pick the screening mode. Single-target ranking, library screening, reverse / panel screening, or selectivity.
  2. Provide the inputs the mode needs. A UniProt accession and SMILES for AqpotencyPotency; an upload_session_id (from upload_files / upload_local_files with purpose='aqpotency_screen') plus a UniProt accession for AqpotencyScreen; a SMILES and a panel enum for AqpotencyScan; a SMILES plus an on-target accession and an off-target list for AqpotencySelectivity.
  3. Invoke the matching tool. AqpotencyPotency, AqpotencyScreen, AqpotencyScan, or AqpotencySelectivity — each returns a job_id in 1–2 seconds.
  4. Review the result with its trust signals. Read potency_mean alongside potency_sigma, ligand_similarity, and protein_in_training before committing to a downstream docking, med-chem, or experimental decision.

Setup Overview

  1. Sign up: Provision your tenant at https://www.sandboxaq.com/. You'll receive your tenant-specific server URL and credentials, and can optionally configure SSO from the platform console. Enterprise customers with negotiated terms: contact mcp-prod@sandboxaq.com instead.
  2. Configure Claude Desktop: Add the server URL to your claude_desktop_config.json (see below). Restart Claude Desktop.
  3. Verify: Ask Claude: "What AQPotency tools does the SandboxAQ MCP Server provide?" — it should list AqpotencyPotency, AqpotencyScreen, AqpotencyScan, and AqpotencySelectivity with parameter descriptions.
  4. Run your first query: Use a prompt like: "Predict the pIC₅₀ of [SMILES] against UniProt P24941 (CDK2)." Claude will submit an AqpotencyPotency job, poll check_job_status, and return potency_mean alongside ligand_similarity, protein_in_training, and potency_sigma.
// claude_desktop_config.json
"mcpServers": {
  "sandboxaq-mcp": {
    "type": "http",
    "url": "https://mcp.{tenant}.aisim.sandboxaq.com"
  }
}

Improving Tool-Invocation Reliability

Two failure modes are common when asking Claude about AQPotency-shaped problems: (1) Claude answers from prior knowledge instead of calling the right AQPotency tool, and (2) Claude picks the wrong tool (e.g. AqpotencyScreen for a single-pair question, or AqpotencyPotency for a batch screen). Both are addressed by client configuration plus prompt hygiene.

  • Disable lazy loading in Claude Desktop — the single most impactful fix. See MCP → Improving tool-invocation reliability for the exact toggle.
  • Name the specific tool in your prompt: "Use AqpotencyPotency to…", "Call AqpotencyScreen with…", "Run AqpotencyScan against panel …", or "Use AqpotencySelectivity with target …".
  • Match the tool to the workload shape. One pair = AqpotencyPotency. Many SMILES vs. one target = AqpotencyScreen. One SMILES vs. many targets = AqpotencyScan. One SMILES vs. a target + explicit off-targets = AqpotencySelectivity.
  • Provide the UniProt ID (or panel name) explicitly rather than a gene symbol — "P00533" or "panel='proteome'" trigger the tool more reliably than "EGFR" or "the whole proteome".
  • Include the SMILES inline or reference the uploaded file so the model doesn't have to infer where the ligand is coming from.
  • If Claude still answers without calling the tool, explicitly ask it to. "Please call AqpotencyScreen with the parameters above" is a valid recovery prompt.

Example Use Cases

Realistic prompts you can issue to Claude once the SandboxAQ MCP Server is connected. Each prompt names the target AQPotency tool explicitly and surfaces the parameters (UniProt ID, panel name, off-targets) that make the call converge on the same tool selection every time. In each case Claude submits the job, polls check_job_status, and returns the result alongside its applicability signals.

1
Rank a focused EGFR library for downstream docking
User Prompt
“I have a focused library of ~3,000 EGFR-directed compounds. Upload the file, then use the AqpotencyScreen tool to rank the top 25 compounds by predicted potency against UniProt P00533 (EGFR) so I can shortlist them for docking. Include ligand_similarity and protein_in_training on each row.”
What Claude Does

Calls upload_local_files with purpose='aqpotency_screen' to push the library to a new upload_session_id, then invokes AqpotencyScreen with that session ID and uniprot_id='P00533'. Polls check_job_status to completion, then get_job_results with limit=25.

Expected Output
Top 25 compounds against EGFR (P00533), sorted by potency_mean descending. Each row reports potency_mean, potency_sigma, ligand_similarity, and protein_in_training. The top three sit in the high-similarity regime (ligand_similarity ≥ 0.85) and are recommended for downstream docking; the next ten carry elevated potency_sigma and may merit re-ranking after docking.
2
Identify likely targets of a phenotypic hit
User Prompt
“Here's a SMILES from a phenotypic screen: <SMILES>. Use the AqpotencyScan tool with panel='proteome' to score it against every protein in the panel, then return the top 10 most likely targets ranked by predicted potency, and flag any that are out-of-domain (protein_in_training=false).”
What Claude Does

Calls AqpotencyScan with the supplied smiles and panel='proteome'. Polls to completion, then get_job_results to read the top targets ranked by potency_mean.

Expected Output
Top targets ranked by predicted potency. Three accessions land in the high-confidence regime (ligand_similarity ≥ 0.8 and protein_in_training=true); two more are flagged as out-of-domain (protein_in_training=false) and should be discounted before deciding which hits to validate experimentally.
3
Screen for CDK7-selective inhibitors
User Prompt
“For the SMILES below, use the AqpotencySelectivity tool with target_uniprot_id='P50613' (CDK7) and off_target_uniprot_ids=['P06493','P24941','P11802','Q00534','P50750'] (CDK1, CDK2, CDK4, CDK6, CDK9). Return per-off-target fold selectivity and the strongest-off-target summary, and flag any panel entry that's out-of-domain.”
What Claude Does

Calls AqpotencySelectivity with the supplied smiles, target_uniprot_id='P50613' (CDK7), and off_target_uniprot_ids=['P06493','P24941','P11802','Q00534','P50750']. Returns per-off-target fold_selectivity plus a fold_selectivity_against_strongest_off_target summary.

Expected Output
Per-off-target fold_selectivity plus a strongest-off-target summary. Compounds with fold_selectivity_against_strongest_off_target ≥ 5 and protein_in_training=true across every CDK in the panel are surfaced as solid CDK7-selective candidates; entries with one or more off-targets out of domain are flagged with a caveat.

Tool Catalog

AQPotency exposes four MCP tools. All four are asynchronous and job-backed — every call returns a job_id in 1–2 seconds, and results are retrieved by polling check_job_status and then calling get_job_results. Applicability-domain signals (ligand_similarity and protein_in_training) are always computed and returned automatically on every prediction at no extra cost — there is no separately callable AD or EDA tool surface.

Tool Purpose Execution
AqpotencyPotency Predict pIC₅₀ for a single protein–ligand pair. Async (job ID, poll + fetch)
AqpotencyScreen Score an uploaded SMILES library (up to 10,000 SMILES) against a single target for virtual screening. Async (job ID, poll + fetch)
AqpotencyScan Screen one ligand against a curated target panel (human_kinome, bowes_safety_panel, or proteome) for reverse screening and off-target triage. Async (job ID, poll + fetch)
AqpotencySelectivity Compute on-target vs. off-target potency and fold_selectivity for one ligand against one on-target and a list of off-targets. Async (job ID, poll + fetch)

`AqpotencyPotency` — single protein–ligand prediction

Predict potency for one ligand against one UniProt target. Bulk submission is not supported in this tool — issue separate calls for multiple molecules. The job submission returns a job_id; the eventual result contains potency_mean, potency_sigma, ligand_similarity, and protein_in_training.

Parameter Required Type Description
smiles yes string A single SMILES string for the query ligand
uniprot_id yes string UniProt accession for the target. Raw protein sequences are not accepted.

`AqpotencyScreen` — library vs. single target

Score an uploaded SMILES library against one target. The library must be uploaded first via upload_files or upload_local_files with purpose='aqpotency_screen'; the returned upload_session_id is then passed to AqpotencyScreen.

Parameter Required Type Description
upload_session_id yes string Session ID returned by the upload step. The uploaded file must be .smi or .csv; if .csv, it must contain a SMILES column (case-sensitive header).
uniprot_id yes string UniProt accession for the target

Hard limits. A screen request accepts at most 10,000 SMILES per call, and the uploaded file must be ≤ 16 MB. Requests over these caps are rejected with a ToolError. Results are returned as a JSON predictions list sorted by potency_mean descending; pass an optional limit (the tool docstrings suggest limit=25) when fetching results.

`AqpotencyScan` — reverse screening vs. curated panels

Screen a single ligand against a predefined target panel and return ranked potential targets. Panels are bundled in the container image — no external API calls at runtime.

Parameter Required Type Description
smiles yes string The query ligand (single SMILES string)
panel yes enum One of bowes_safety_panel, human_kinome, or proteome.

`AqpotencySelectivity` — on-target vs. off-target ratios

Compute selectivity for a single ligand against a single on-target and a list of off-targets. Returns per-off-target fold_selectivity plus a fold_selectivity_against_strongest_off_target summary. The off_targets list in the response is ordered lexicographically by UniProt accession, not by submission order.

Parameter Required Type Description
smiles yes string The query ligand (single SMILES string)
target_uniprot_id yes string UniProt accession of the on-target
off_target_uniprot_ids yes array List of off-target UniProt accessions. Must contain ≥1 entry, all entries distinct, and none may equal target_uniprot_id.

Request & Response Schemas

Every AQPotency tool follows the same three-step job lifecycle over MCP: (1) call the tool to submit a job and receive a job_id; (2) poll check_job_status until is_terminal is true; (3) fetch the result with get_job_results.

`AqpotencyPotency` request

AQPotency tools are invoked as standard MCP tool calls with named arguments — there is no client_context_id / tool_name / parameters wrapper.

{
  "name": "AqpotencyPotency",
  "arguments": {
    "smiles": "Cc1ccc(NC(=O)c2ccc(CN3CCN(C)CC3)cc2)cc1Nc1nccc(-c2cccnc2)n1",
    "uniprot_id": "P50613"
  }
}

Submission ack (every AQPotency tool)

Every AQPotency tool returns the same lightweight acknowledgement on submission. The job_id is the handle for the subsequent polling and result-fetch calls.

{
  "job_id": "0c5b1f3e-9b2c-4f4a-9a4e-2bfa1c4e1101",
  "status": "pending",
  "message": "Job submitted. Use check_job_status to poll for completion, then get_job_results to fetch the result."
}

Polling with `check_job_status`

While the job is running, check_job_status returns is_terminal: false and a recommended poll_after_seconds interval. On completion it returns is_terminal: true; elapsed time is included in the progress_message string (there is no separate elapsed_seconds field).

{
  "job_id": "0c5b1f3e-9b2c-4f4a-9a4e-2bfa1c4e1101",
  "status": "completed",
  "is_terminal": true,
  "progress_message": "Job complete (4s elapsed)."
}

`AqpotencyPotency` result (via `get_job_results`)

get_job_results returns a predictions list. Each entry includes the identifying smiles and uniprot_id plus the real output fields — potency_mean, potency_sigma, ligand_similarity, and protein_in_training. Applicability fields are only present when computable.

{
  "predictions": [
    {
      "smiles": "Cc1ccc(NC(=O)c2ccc(CN3CCN(C)CC3)cc2)cc1Nc1nccc(-c2cccnc2)n1",
      "uniprot_id": "P50613",
      "potency_mean": 7.82,
      "potency_sigma": 0.41,
      "ligand_similarity": 0.87,
      "protein_in_training": true
    }
  ]
}

`AqpotencyScreen` request

The compound library must be uploaded ahead of the screen call via upload_files or upload_local_files with purpose='aqpotency_screen'. Pass the returned upload_session_id and the target's UniProt accession:

{
  "name": "AqpotencyScreen",
  "arguments": {
    "upload_session_id": "us_2f8e1c4a9b7d4e10",
    "uniprot_id": "P50613"
  }
}

`AqpotencyScreen` result (via `get_job_results`)

Results are returned as a JSON predictions list sorted by potency_mean descending. Pass an optional limit (the tool docstrings suggest limit=25) to cap the number of rows returned. Each entry mirrors the potency shape but uses target_uniprot_id for the target accession.

{
  "predictions": [
    {
      "smiles": "Cc1ccc(NC(=O)c2ccc(CN3CCN(C)CC3)cc2)cc1Nc1nccc(-c2cccnc2)n1",
      "target_uniprot_id": "P50613",
      "potency_mean": 7.50,
      "potency_sigma": 0.40,
      "ligand_similarity": 0.90,
      "protein_in_training": true
    }
  ]
}

Output Field Reference

Field Type Description
job_id string Unique identifier returned on submission; pass to check_job_status and get_job_results.
status string pending, running, completed, or failed.
is_terminal bool true once the job has reached a terminal state and results can be fetched.
progress_message string Human-readable progress; includes elapsed-time text on completion.
smiles string Ligand SMILES echoed on each prediction.
uniprot_id / target_uniprot_id string Target accession. AqpotencyPotency uses uniprot_id; AqpotencyScreen and AqpotencySelectivity use target_uniprot_id.
potency_mean float Predicted potency on the pIC₅₀ scale (higher = more potent). Use for ranking, not absolute affinity.
potency_sigma float Per-pair standard deviation from the Gaussian-mixture head, in pIC₅₀ units. Larger σ = lower confidence.
ligand_similarity float (0–1) Maximum Tanimoto similarity of the query ligand to the training set.
protein_in_training bool Whether the target was represented in the training set. false means the prediction is extrapolating to an unseen protein.
fold_selectivity float AqpotencySelectivity only. Per-off-target potency ratio vs. the on-target.
fold_selectivity_against_strongest_off_target float AqpotencySelectivity only. Convenience summary against the most-potent off-target.
off_targets array AqpotencySelectivity only. Per-off-target predictions, ordered lexicographically by UniProt accession.

Interpreting Results

Use AQPotency for Ranking, Not Absolute Potency

AQPotency is designed and validated as a rank-correlation model. Spearman correlation is typically meaningful; R² is often poor and can be negative for out-of-domain targets or ligands. Use predictions to order compounds (top-N for downstream docking/FEP, bottom-N to discard), not to report headline binding constants.

Do not quote potency_mean as an absolute affinity. A potency_mean of 7.8 should be read as "this compound ranks near the top of the library for this target", not "this compound has Ki ≈ 16 nM." Combine with docking, FEP, or experimental follow-up before committing to a number.

Applicability Domain & Uncertainty

Every prediction ships with three confidence signals. Applicability domain is always on and surfaces as two distinct fields (not a single fused score); there is no separate applicability_domain tool to call.

Signal Type Interpretation
ligand_similarity float (0–1) Maximum Tanimoto similarity of the query ligand to the training set. Higher = more reliable; a low value means the ligand is unlike anything the model has seen and the prediction should be treated as a noisy ranking signal at best.
protein_in_training bool Whether the target was represented in training. false means the model is extrapolating to an unseen protein — discount the prediction accordingly.
potency_sigma float (pIC₅₀ units) Per-pair standard deviation from the Gaussian-mixture head. A large σ alongside a high potency_mean is a flag to re-rank with AD-aware filters or to fall back to docking/FEP.

LLM behaviour: The MCP tool descriptions instruct the assistant to caveat predictions with low ligand_similarity or high potency_sigma, rather than presenting a single number with false confidence. There is no applicability_domain or eda follow-up tool to call — applicability signals are already returned automatically with every prediction.

Selectivity & Off-Target Reasoning

Selectivity ratios (e.g., CDK7 vs. other CDKs) are most reliable when every target in the comparison sits inside the applicability domain. A high apparent selectivity driven by an out-of-domain off-target prediction is a common failure mode — filter the off-target set on ligand_similarity and protein_in_training before acting on the ratios. Selectivity outputs are most useful for narrowing a large candidate set to a smaller shortlist for downstream docking, medicinal-chemistry review, or experimental follow-up — not as a standalone go/no-go signal.

Pricing

AQPotency is priced per protein–ligand pair evaluated, on a shared two-tier schedule that applies uniformly to all four tools (AqpotencyPotency, AqpotencyScreen, AqpotencyScan, AqpotencySelectivity). The first 10 pairs of every call are billed at $0.01 / pair; every pair beyond that in the same call is billed at $0.001 / pair.

A pair is one protein–ligand combination scored by the model. Each tool defines its own per-call workload envelope (see Limits & Quotas). Applicability-domain signals (ligand_similarity, protein_in_training) and the potency_sigma uncertainty estimate are returned with every prediction at no additional cost — there is no premium trust-stack add-on.

Tiered Per-Pair Pricing

Tier (per call) Rate Reference
First 10 pairs $0.01 / pair $1.00 per 100 pairs
Pairs 11 – 10,000 $0.001 / pair $1.00 per 1,000 pairs

Each call starts a fresh tier. A screen of 10,000 SMILES pays tier-1 pricing on its first 10 pairs; a screen that splits across two 5,000-SMILES calls pays tier-1 pricing on each call (an extra $0.09 vs. a single batched call). Batch aggressively where possible.

What counts as a pair (per tool):

Tool What counts as a pair
AqpotencyPotency 1 protein–ligand pair (the call itself is the pair)
AqpotencyScreen Each SMILES in the library × the target
AqpotencyScan Each panel protein × the ligand
AqpotencySelectivity Each (on-target or off-target) × the ligand

Example call costs (all follow the same tiered formula, min(N,10) × $0.01 + max(0, N-10) × $0.001):

  • AqpotencyPotency — 1 pair = $0.01
  • AqpotencyPotency — 10 pairs = $0.10
  • AqpotencyScreen of 11 SMILES = $0.101
  • AqpotencySelectivity — 75 pairs = $0.165
  • AqpotencySelectivity — 100 pairs = $0.19
  • AqpotencyScreen of 750 SMILES = $0.84
  • AqpotencyScreen of 1,000 SMILES = $1.09
  • AqpotencyScreen of 1,001 SMILES = $1.091
  • AqpotencyScreen of 10,000 SMILES (per-call cap) = $10.09
  • AqpotencyScan against bowes_safety_panel (46 proteins) = $0.136
  • AqpotencyScan against human_kinome (604 proteins) = $0.694
  • AqpotencyScan against proteome (20,431 proteins) = $20.521

Per-call workload caps still live in Limits & Quotas — they're an envelope, not a billing unit. The 10,000-pair per-call cap applies to AqpotencyScreen only; AqpotencyScan runs against curated server-side panels and is not subject to that cap.

Individual vs Enterprise tier terms — persona, platform fee, SLA, support, and deployment differences are consolidated on the Pricing page → SandboxAQ MCP Server section.

Enterprise terms: Enterprise customers can negotiate volume-based pricing, custom SLAs, customer-tenant deployment, and marketplace or procurement arrangements as part of a separate enterprise agreement. Contact mcp-prod@sandboxaq.com to discuss.

Limits & Quotas

AQPotency is designed for high-throughput ranking. The following limits are enforced server-side to keep responses inside LLM timeout windows and to protect shared hosted infrastructure.

Limit Individual Enterprise
SMILES per AqpotencyScreen request 10,000 (hard cap) 10,000 (hard cap)
Max upload file size for AqpotencyScreen 16 MB 16 MB
Job-ID return (all four tools) <1–2s; processing async (poll check_job_status) <1–2s; processing async (poll check_job_status)
Curated panels available (AqpotencyScan) bowes_safety_panel, human_kinome, proteome bowes_safety_panel, human_kinome, proteome
Rate limit 10 RPM 100 RPM
Minimum container resources ≥8 vCPU, ≥16–32 GB RAM (AD-on) ≥8 vCPU, ≥16–32 GB RAM (AD-on)

All four AQPotency tools are asynchronous. Every call returns a job_id in 1–2 seconds; results are fetched by polling check_job_status and then calling get_job_results. AqpotencyScreen requests that exceed the 10,000-SMILES or 16 MB caps are rejected with a ToolError.

Security & IP Protection

  • Telemetry: Per-call usage metadata (counts, identifiers, wall-clock time) is logged for billing reconciliation and capacity planning.
  • Privacy: See the SandboxAQ Privacy Policy for complete details on data handling and retention.
  • Organizational isolation: Usage, billing, and data are isolated per organization (or per Tenant ID on the managed MCP surface). Cross-organization access is not possible.