mcp group is the operator interface to MCP sessions. All commands
require an API key with admin scope.
--identity idn_... to label the session with a persona (recorded, not enforced yet). The create reply prints the bearer once;
store it immediately.
list and show return only metadata and the non-sensitive prefix. revoke is one-way and is
enforced on the credential’s next request.