How does auth work in practice? What’s the login process from the user’s PoV?

I would be extremely cautious about what you log from LLMs in a cloud MCP server, who you make those logs available to, data retention policies, etc.

They are going to be a PII landmine.