Platform MCP

A²D exposes an HTTP-Streamable Model Context Protocol endpoint so AI agents can drive the platform directly — creating MCP servers, agent cards, REST APIs, tests, and exploratory sessions — without scripting the UI.

What it is

The Platform MCP is a first-class MCP server that fronts A²D’s own data model. It speaks Streamable HTTP (JSON-RPC over HTTP with optional Server-Sent Events for long responses) and authenticates with a per-organization API key.

Endpoint URL: https://<your-a2d-host>/api/platform-mcp/mcp
Transport: MCP Streamable HTTP (POST + optional Accept: text/event-stream).
Auth: Authorization: Bearer <key> or X-API-Key: <key>.
Tenancy: Every key resolves to a single organization; all tool calls are scoped to that org via Supabase RLS + service-role checks.

What you can do with it

The Platform MCP surfaces every A²D authoring primitive as an MCP tool. Broadly:

Design — design_mcp_server, design_agent_card, design_rest_api, and their ai_generate_full_* counterparts.
Edit — update_mcp_server, add_mcp_tool, add_mcp_resource, add_mcp_prompt, add_agent_skill, add_rest_endpoint, and their delete/duplicate/publish variants. design_mcp_server and update_mcp_server also accept provider_organization / provider_url, merged into config.provider — the same field the UI’s server detail page saves.
Test — create_test, create_suite, run_test, run_suite, get_run_results.
Explore — create_exploratory_session, activate_exploratory_session, add_asset_to_session, add_invite_to_session.
Publish — publish_mcp_server, publish_agent_card, publish_to_exchange_mcp_server, publish_to_exchange_agent_card.
Dashboard — show_dashboard_summary, show_dashboard_assets, get_dashboard_stats.
Compliance — get_compliance_report computes the design-rules compliance report (passed rules + issues) for any MCP server, agent card, or REST API by id — the same data the UI’s compliance tab shows. asset_type is optional; when omitted, the tool infers it by looking the id up across all three asset tables. Reports are computed on demand and are not persisted.

See the full tool list by calling tools/list against the endpoint with any MCP-capable client.

Getting started

Before your first request you need a Platform API key. Mint one from Settings → Platform MCP. Copy the key immediately — A²D shows it exactly once. See Platform API Keys for the full flow.

Initialize

curl -X POST https://<your-a2d-host>/api/platform-mcp/mcp \
  -H "Authorization: Bearer $A2D_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "initialize",
    "params": {
      "protocolVersion": "2024-11-05",
      "capabilities": {},
      "clientInfo": {"name": "curl", "version": "1.0"}
    }
  }'

List tools

curl -X POST https://<your-a2d-host>/api/platform-mcp/mcp \
  -H "Authorization: Bearer $A2D_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/list"}'

Call a tool

curl -X POST https://<your-a2d-host>/api/platform-mcp/mcp \
  -H "Authorization: Bearer $A2D_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{
    "jsonrpc": "2.0",
    "id": 3,
    "method": "tools/call",
    "params": {
      "name": "list_mcp_servers",
      "arguments": {}
    }
  }'

Cursor / Claude Desktop / VS Code

Point any MCP-capable client at the endpoint URL and provide the API key as a Bearer token. A²D includes prebuilt configs for Cursor, Claude Desktop, VS Code, Gemini CLI, Claude Code, Codex CLI, and Windsurf on the Settings → Platform MCP → Client Setup panel.

Rate limits

The data plane is rate-limited per organization to prevent one misbehaving key from starving the tenant. Limits are enforced in memory on the API route and return 429 with a Retry-After header when exceeded.

Policy-facing routes (/api/platform/[id]/mcp/{spec,validate,evidence}) have their own per-key per-route rate limits — see Policy-Scoped Keys for details.

Scope model

Every Platform API key has a scope:

Scope	Data plane (`/api/platform-mcp/mcp`)	Policy routes (`/api/platform/[id]/mcp/*`)
`full`	✅ Allowed	✅ Allowed for every asset in the org
`policy`	❌ 403 Forbidden	✅ Allowed only for the bound asset ids

A key minted before the scope column existed is treated as full for backward compatibility. To lock a key down to the policy surface, generate a new key with Bind to MCP server set — see Policy-Scoped Keys.

Settings UI — Platform API Keys covers key lifecycle: create, revoke, rotation, bind-on-create.
Policies — Flex Gateway Policies call /api/platform/[id]/mcp/spec and /mcp/validate and post evidence to /mcp/evidence. Policy-scoped keys are the recommended credential for those calls.
MCP Servers — the Platform MCP creates and edits MCP Servers; it does not replace them.

Next Steps

Mint your first key from Platform API Keys.
Lock a key to a single MCP server with Policy-Scoped Keys.
Wire a Flex Gateway policy to the platform via Flex Gateway Policies.

The Platform MCP is A²D’s public authoring API for agents. Every operation a human can do in the UI, an agent can do through this endpoint.

Overview Platform API Keys