Platform MCP

A²D exposes an HTTP-Streamable Model Context Protocol endpoint so AI agents can drive the platform directly — creating MCP servers, agent cards, REST APIs, tests, and exploratory sessions — without scripting the UI.

What it is

The Platform MCP is a first-class MCP server that fronts A²D’s own data model. It speaks Streamable HTTP (JSON-RPC over HTTP with optional Server-Sent Events for long responses) and authenticates with a per-organization API key.

Endpoint URL: https://<your-a2d-host>/api/platform-mcp/mcp
Transport: MCP Streamable HTTP (POST + optional Accept: text/event-stream).
Auth: Authorization: Bearer <key> or X-API-Key: <key>.
Tenancy: Every key resolves to a single organization; all tool calls are scoped to that org via Supabase RLS + service-role checks.

What you can do with it

The Platform MCP surfaces every A²D authoring primitive as an MCP tool. Broadly:

Design — design_mcp_server, design_agent_card, design_rest_api, and their ai_generate_full_* counterparts.
Edit — update_mcp_server, add_mcp_tool, add_mcp_resource, add_mcp_prompt, add_agent_skill, add_rest_endpoint, and their delete/duplicate/publish variants.
Test — create_test, create_suite, run_test, run_suite, get_run_results.
Explore — create_exploratory_session, activate_exploratory_session, add_asset_to_session, add_invite_to_session.
Publish — publish_mcp_server, publish_agent_card, publish_to_exchange_mcp_server, publish_to_exchange_agent_card.
Dashboard — show_dashboard_summary, show_dashboard_assets, get_dashboard_stats.

See the full tool list by calling tools/list against the endpoint with any MCP-capable client.

Getting started

Before your first request you need a Platform API key. Mint one from Settings → Platform MCP. Copy the key immediately — A²D shows it exactly once. See Platform API Keys for the full flow.

Initialize

curl -X POST https://<your-a2d-host>/api/platform-mcp/mcp \
  -H "Authorization: Bearer $A2D_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "initialize",
    "params": {
      "protocolVersion": "2024-11-05",
      "capabilities": {},
      "clientInfo": {"name": "curl", "version": "1.0"}
    }
  }'

List tools

curl -X POST https://<your-a2d-host>/api/platform-mcp/mcp \
  -H "Authorization: Bearer $A2D_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/list"}'

Call a tool

curl -X POST https://<your-a2d-host>/api/platform-mcp/mcp \
  -H "Authorization: Bearer $A2D_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{
    "jsonrpc": "2.0",
    "id": 3,
    "method": "tools/call",
    "params": {
      "name": "list_mcp_servers",
      "arguments": {}
    }
  }'

Cursor / Claude Desktop / VS Code

Point any MCP-capable client at the endpoint URL and provide the API key as a Bearer token. A²D includes prebuilt configs for Cursor, Claude Desktop, VS Code, Gemini CLI, Claude Code, Codex CLI, and Windsurf on the Settings → Platform MCP → Client Setup panel.

Rate limits

The data plane is rate-limited per organization to prevent one misbehaving key from starving the tenant. Limits are enforced in memory on the API route and return 429 with a Retry-After header when exceeded.

Policy-facing routes (/api/platform/[id]/mcp/{spec,validate,evidence}) have their own per-key per-route rate limits — see Policy-Scoped Keys for details.

Scope model

Every Platform API key has a scope:

Scope	Data plane (`/api/platform-mcp/mcp`)	Policy routes (`/api/platform/[id]/mcp/*`)
`full`	✅ Allowed	✅ Allowed for every asset in the org
`policy`	❌ 403 Forbidden	✅ Allowed only for the bound asset ids

A key minted before the scope column existed is treated as full for backward compatibility. To lock a key down to the policy surface, generate a new key with Bind to MCP server set — see Policy-Scoped Keys.

Settings UI — Platform API Keys covers key lifecycle: create, revoke, rotation, bind-on-create.
Policies — Flex Gateway Policies call /api/platform/[id]/mcp/spec and /mcp/validate and post evidence to /mcp/evidence. Policy-scoped keys are the recommended credential for those calls.
MCP Servers — the Platform MCP creates and edits MCP Servers; it does not replace them.

Next Steps

Mint your first key from Platform API Keys.
Lock a key to a single MCP server with Policy-Scoped Keys.
Wire a Flex Gateway policy to the platform via Flex Gateway Policies.

The Platform MCP is A²D’s public authoring API for agents. Every operation a human can do in the UI, an agent can do through this endpoint.

Overview Platform API Keys