Who an MCP caller is in Issho's rooms: the Issho.Tool.Context its tool calls run with. The one place where an MCP endpoint's authorization (Sake's, your own, or none) meets Issho: the agent and the options of its joins come from the call.

The settings, in the app's config or from Issho.MCP.Setup:

config :issho, Issho.MCP,
  instance: MyApp.Issho,
  agent: {MyApp.Collaboration, :agent},
  idle: 600_000

agent is {module, function} or a function of one argument, called with the call's Sake.Context (its scope is the principal your endpoint's authorization put there; nil without one). It gives {actor, opts}: the agent, and the options of its joins (:on_behalf_of, :claims, :can):

def agent(%Sake.Context{scope: %MyApp.User{} = user}),
  do: {%{id: "assistant:#{user.id}", name: "Assistant", kind: :agent}, on_behalf_of: user}

def agent(%Sake.Context{scope: %MyApp.Service{} = service}),
  do: {%{id: "service:#{service.id}", name: service.name, kind: :service}, []}

Without agent, the caller is an agent named for its MCP client ("Claude Code"): on behalf of the principal when the principal is an Issho.Actor, or acting as itself when there is none.