Register an org-level upstream MCP server (http transport, org visibility) and mint its bearer grant key. The grant key is returned exactly once and is never retrievable afterward; upstream header values go in and never come back. Rejected with 409 while any agent already enables an MCP server under the requested name — agents bind by name, so a new provider must not silently capture existing selections.