@@ -62,4 +62,4 @@ motoko-core           v2.4.0
 cdk-rs                ic-cdk v0.20.1 / ic-cdk-timers v1.0.0 / ic-cdk-executor v2.0.0  317f55c
 candid                2025-12-18  # candid v0.10.20, didc v0.5.4                2e4a2cf
 response-verification v3.1.0                                                    18c5a37
-internetidentity      release-2026-07-27                                         f94dde5f
+internetidentity      release-2026-07-31                                         e646fe93
@@ -350,6 +350,16 @@ type InternetIdentityInit = record {
     // via HTTP outcalls when no DNSSEC chain is available — see
     // `docs/ongoing/email-recovery.md` §7.6. Same set/clear pattern.
     doh_config : opt opt DohConfig;
+    // URL of the official MCP connector the deployment ships, if any. Same
+    // set/clear pattern as `dnssec_config`: null keeps the previously stored
+    // value, `opt null` clears it, `opt opt "https://..."` sets it.
+    mcp_official_url : opt opt text;
+    // One-shot upgrade arg driving the MCP config migration: `opt true` gives
+    // every anchor "enabled, official connector", since neither a value stored
+    // before the official connector existed nor an absent config was ever a
+    // choice about it. Unset means no migration, and the migration is refused
+    // when the deployment ships no `mcp_official_url`.
+    mcp_config_migration : opt bool;
 };
 
 // DNSSEC trust-anchor list. Any feature that needs DNSSEC-verified DNS
@@ -1164,13 +1174,18 @@ type McpConfig = record {
 };
 
 // Result of prepare_mcp_registration_delegation: the canister-signature public
-// key the registration delegation is rooted at (P_reg), and the (short)
-// expiration of that delegation. The frontend fetches the signed delegation via
-// get_mcp_registration_delegation and delivers the chain to the trusted MCP
+// key the registration delegation is rooted at (P_reg), the (short) expiration
+// of that delegation, and the identity's resolved trusted_url (the anchor's own
+// server if set, else the official connector). trusted_url is certified (this
+// is an update call), so the frontend can gate delivery on it - delivering the
+// chain only when the connect link's origin matches - rather than trusting an
+// uncertified mcp_get_config query. The frontend fetches the signed delegation
+// via get_mcp_registration_delegation and delivers the chain to the trusted MCP
 // server, which redeems it with mcp_register_v2.
 type PrepareMcpRegistrationDelegation = record {
     user_key : UserKey;
     expiration : Timestamp;
+    trusted_url : text;
 };
 
 // Result of mcp_register_v2: the expiration (ns since epoch) of the MCP session
@@ -1887,7 +1902,11 @@ service : (opt InternetIdentityInit) -> {
     // devices. Read by the Settings UI and the /mcp connect flow (which verifies
     // the connecting origin against it). Returns the disabled, no-server default
     // for an unauthorized caller or an anchor that never wrote a config.
-    mcp_get_config : (anchor_number : UserNumber) -> (McpConfig) query;
+    // `null` means the identity has never written a config — distinct from a
+    // stored one that is switched off. The two behave differently at /mcp: the
+    // first may connect the deployment's official connector (completing the
+    // consent is what enables it), the second is sent back to Settings.
+    mcp_get_config : (anchor_number : UserNumber) -> (opt McpConfig) query;
 
     // Persist the identity's trusted-MCP-server config so it syncs across the
     // identity's devices. Authenticated as the identity, so only the user — never
@@ -1906,9 +1925,15 @@ service : (opt InternetIdentityInit) -> {
     // mcp_get_accounts), and null uses the anchor's default account there; an
     // account_number that isn't the anchor's at target_origin is rejected as
     // Unauthorized. max_ttl is the requested lifetime in ns, defaulting to and
-    // capped at 1 hour, and never outliving the session grant. The resolved
-    // account_number is returned in McpPrepareDelegation so it can be threaded
-    // into mcp_get_delegation (the default account at an origin is mutable).
+    // capped at 5 minutes, and never outliving the session grant. The cap is
+    // short because it is the residual window revocation cannot reach: once the
+    // session is revoked no further delegation can be minted, but one already
+    // minted stays usable until it expires. Re-minting is unattended (a fresh
+    // prepare/get pair signed by the session key, no user interaction), so
+    // re-mint rather than holding a delegation for the life of the session. The
+    // resolved account_number is returned in McpPrepareDelegation so it can be
+    // threaded into mcp_get_delegation (the default account at an origin is
+    // mutable).
     mcp_prepare_delegation : (
         target_origin : FrontendHostname,
         account_number : opt AccountNumber,