Developers
Connect to the CentraKit API MCP server, understand its auth flow, and configure supported clients.
The CentraKit API exposes an MCP server at /api/mcp.
CentraKit serves the stateless MCP 2026-07-28 protocol natively over Streamable HTTP. Clients using 2025-era Streamable HTTP remain supported through the same endpoint.
https://api.centrakit.com/api/mcphttps://api.localhost/api/mcpThe current protocol does not use transport sessions or Mcp-Session-Id. Legacy HTTP+SSE endpoints such as /api/sse and /api/message are not supported.
Clients can call server/discover to retrieve the supported protocol versions, server identity, and tools capability before making other requests. Discovery and the deterministic tool catalog include one-hour public cache hints because they only change with a deployment; tool results and organization data are not cached by MCP.
The MCP server is protected with bearer-token auth and OAuth 2.1 discovery.
https://api.centrakit.com/.well-known/oauth-protected-resourcehttps://api.localhost/.well-known/oauth-protected-resourcehttps://<project-ref>.supabase.co/auth/v1Clients should use the protected-resource metadata endpoint to discover the authorization server, then request a bearer token from Supabase's OAuth server.
CentraKit publishes the MCP resource URL in metadata as https://api.centrakit.com/api/mcp or https://api.localhost/api/mcp locally. Supabase OAuth tokens commonly keep the default aud claim of authenticated, and the API accepts that default audience as well as any stricter MCP_RESOURCE_AUDIENCE override configured by the deployment.
The MCP boundary verifies issuer, audience, signature, expiry, and configured scopes. Verified bearer metadata is reused for MCP-local current-user and usage-metering work. OpenAPI-derived tools intentionally call the matching REST operation with the same bearer token; REST verifies it again because it remains a separate public trust boundary and owns the canonical validation, authorization, audit, usage, and error contract.
For local development and agent workflows, use the CLI browser login to obtain and refresh a bearer token-backed session:
centrakit loginThe CLI uses a loopback PKCE flow against Supabase OAuth 2.1 and stores the resulting access and refresh tokens locally for later CLI and MCP usage.
Non-interactive environments should continue to provide an explicit bearer token:
centrakit --token <access-token> ...CENTRAKIT_TOKENThis is the supported path for CI, scripts, and MCP hosts that already know how to inject a bearer token.
If your MCP host supports Streamable HTTP directly, connect to /api/mcp.
{
"centrakit-api": {
"url": "https://api.centrakit.com/api/mcp"
}
}mcp-remoteSome hosts still need mcp-remote, especially when the MCP server is OAuth protected.
{
"centrakit-api": {
"command": "npx",
"args": ["-y", "mcp-remote", "https://api.centrakit.com/api/mcp"]
}
}Claude Desktop currently connects through mcp-remote.
~/Library/Application Support/Claude/claude_desktop_config.jsonCursor config path:
~/.cursor/mcp.jsonUse direct Streamable HTTP if your Cursor setup supports the auth flow you need. If OAuth-secured remote MCP is not handled correctly by your current client version, fall back to mcp-remote.
Windsurf config path:
~/.codeium/windsurf/mcp_config.jsonUse the same direct URL or mcp-remote pattern as above, depending on host permissions.
The MCP tool catalog is generated from the committed API OpenAPI and Hey API outputs, with a deliberate allowlist applied on top. Tool responses include both a text fallback and structuredContent when the API returns JSON. The 60 tools are grouped below.
getApiHealthV1, getCurrentUserlistTasks, createTask, getTask, setTaskStatus, updateTasklistCustomers, createCustomer, getCustomer, updateCustomer, listCustomerAssets, getCustomerAssetlistProducts, createProduct, getProduct, updateProductlistQuotes, createQuote, getQuote, updateQuotelistTags, createTag, getTag, updateTaglistWebhookDeliveries, getWebhookDeliverylistWebhookDestinations, createWebhookDestination, getWebhookDestination, updateWebhookDestination, deleteWebhookDestination, rotateWebhookDestinationSecretlistWebhookEndpoints, createWebhookEndpoint, getWebhookEndpoint, updateWebhookEndpoint, deleteWebhookEndpoint, rotateWebhookEndpointSecret, rotateWebhookEndpointTokenlistWorkflowDefinitions, getWorkflowDefinition, listWorkflowRuns, getWorkflowRun, startWorkflowRunretrieveKnowledge, sendInboxThreadReplylistAgendaItems, createAgendaItem, getAgendaItem, updateAgendaItem, deleteAgendaItem, moveAgendaItemlistFileDrives, listFileNodeChildren, getFileNode, createFileDownloadlistOrganizationAuditEvents, createOrganizationAuditExport, getOrganizationAuditExportEvery tool publishes read or mutate metadata and its required OAuth scope. Read tools require mcp:read. New mutation tools require mcp:write; createTask and setTaskStatus continue to accept mcp:read for compatibility with the original documented MCP contract. REST authorization and organization RBAC remain authoritative after the MCP scope check.
OpenAPI-derived tools use a nested MCP input shape:
{
"pathParams": {
"organizationId": "..."
},
"query": {
"limit": 50,
"offset": 0
},
"body": {}
}pathParams are required when the REST path contains parameters such as organizationId, taskId, customerId, or quoteId. query is optional and validated against the generated operation schema when provided. Mutation body values are validated against the generated operation schema before proxying; the REST route then revalidates its owning domain schema.
The API MCP server currently exposes tools only. It does not yet register MCP Apps resources, prompts, or interactive widget UIs. A future MCP Apps pass can add ui:// resources and tool metadata for hosts that render iframe-based tool results.
401 Unauthorized: the client is missing a bearer token, the token is invalid, or the token audience is neither Supabase's default authenticated audience nor the configured MCP audience override.403 Forbidden: the token is valid but does not satisfy the required permissions for the requested operation./.well-known/oauth-protected-resource is reachable and the authorization server configuration is valid.https://api.localhost before connecting the client.