Skip to main content

MCP

The platform is also an MCP server, so an AI assistant that speaks the protocol can author and read content on a person's behalf: the same atoms, sequences and journeys the portal shows, under the same permissions.

Connecting​

Add one URL to the MCP client:

https://<api host>/mcp

The client opens a browser; the person signs in with the account they already have, on their own tenant's sign-in page, and consents. There is no API key or configuration file.

The person must be able to author content in a tenant whose mcp.enabled configuration is on, and have a second factor if their role requires one. The connection appears in their own session list as MCP client, and they end it there like any other session.

At connect, the client is told what the server is and pointed at this documentation, the whole site as one file at /llms.txt, and at Intervengine's guide.

What it reaches​

One tool per API operation, named by the operation's id (listJourneys, updateSequenceVersion, …), taking the operation's parameters and its body as body. Every call runs through the same route the portal uses, so permissions, tenant isolation and the audit trail are the ordinary ones, and every act is attributed to the person.

Never anything belonging to a participant: not their record, assignments, readings, chats, attachments or audit trail. Also not webhooks or API keys, and not content export or import. Public catalog media is reachable; private files are not.

getSession says which tenant the connection is working in, and updateSession with a tenantId moves it to another where MCP access is on, without moving the person's portal.

Switching it on​

The deployment must enable MCP, and the tenant's mcp.enabled must be true, a platform admin's setting. With either off, a connection is refused with a message that says which.

How it authenticates​

The MCP server is an OAuth 2.1 resource server and the identity provider is its authorisation server. The client discovers the provider, registers itself and signs the person in with PKCE. The access token it ends up with opens /mcp and nothing else: presented to any other endpoint it is refused. Revoking the connection at the provider, or ending the session, stops the client on its next call.

Prompt injection is a risk the tenant accepts by turning MCP on: text planted in content could steer an agent to do anything the person's role allows. What must never be one prompt away is held by the platform admin role and not by tenant admins.