POST. | Purpose | Endpoint |
|---|---|
| MCP endpoint (user tools) | POST /mcp |
| MCP endpoint (application-administration tools) | POST /mcp/admin |
| Authorization-server metadata (RFC 8414) | GET /.well-known/oauth-authorization-server |
| Protected-resource metadata (RFC 9728) | GET /.well-known/oauth-protected-resource |
| Dynamic client registration (RFC 7591) | POST /api/v1/oauth/register |
| Server card (discovery, no connection needed) | GET /.well-known/mcp.jsonGET /.well-known/mcp/server.json |
| Authorization (consent) endpoint | GET /api/v1/oauth/authorize |
Each application publishes a server card — a small JSON document describing this tenant’s MCP server, so a client can learn the endpoint, its transport and how to authenticate without connecting first. It is served at /.well-known/mcp.json and, for registry tooling that looks there, at /.well-known/mcp/server.json; both return the same document and it validates against the Model Context Protocol registry’s server.json schema. The card appears only once an administrator has enabled MCP for the application — until then the paths return 404, which is the honest answer to “is there an MCP server here?”
The remotes array carries the user endpoint. The admin endpoint is a separate server with its own tool set, so it is advertised under _meta rather than as a second transport of the same server, alongside the OAuth discovery URLs.
The MCP server uses OAuth 2.1 with PKCE (code_challenge_methodS256) and the mcp scope. A compliant MCP client needs no manual configuration: when it first calls /mcp without a token it receives a 401 whose WWW-Authenticate header points at the protected-resource metadata, from which the client discovers the authorization server, registers itself, opens the in-app consent page, and exchanges the resulting authorization code (with its PKCE verifier) for a token. The issued token is an ordinary Stardraw JWT — the same kind described under Authentication — so the MCP server can only do what the signed-in user is permitted to do.
MCP must be enabled by an application administrator (it is off by default). Each tool the assistant sees is the intersection of the administrator’s allowed-tools list and the user’s own access rights, and every tool call is logged. Tools that create or change many things — placements, shapes, connectors, cables, moves, restyles — take an array of entries, so a whole edit is one call. The available tools include:
| Area | Tools |
|---|---|
| Projects & snapshots | list_projects, get_project, create_project, update_project, create_snapshot |
| Products & cables | search_products, get_product_details, list_project_products, add_products_to_project, remove_product_from_project, get_settings_schema, set_product_settings, list_cable_types, list_project_cables, set_cable_ids, renumber_cables, list_conduits, create_conduits, assign_cables_to_conduits |
| Views | list_views, get_view, list_view_templates, create_view, list_view_items, get_view_drawing, show_views |
| Drawing & placing | place_products, create_view_items |
| Connections | list_item_anchors, mount_product, unmount_product, connect_products, disconnect_products, set_cable_path, create_off_page_references, create_view_connectors |
| Editing items | move_view_items, rotate_view_items, order_view_items, set_view_item_styles, set_text_content, resize_view_rectangle, set_view_polyline_points, set_view_path_d, delete_view_items |
| Reports | list_reports, generate_report_pdf |
| Application | get_application |
The show_views tool returns an interactive, tabbed drawing viewer (an MCP Apps UI widget) so an assistant can render a project’s views inline.
A second endpoint, POST /mcp/admin, exposes the application-administration tools. It authenticates exactly like /mcp — same OAuth 2.1 flow, same discovery documents — but each tool is gated on the tenant-administration privilege the underlying endpoint already checks, so an ordinary user sees none of them. Add it to your MCP client as a separate server if you want an assistant to curate the product catalog.
| Area | Tools |
|---|---|
| Product catalog | list_products, create_products, update_products, delete_products, audit_products, get_product_usage, list_product_changes |
| Catalog reindex | reindex_products, get_reindex_status, cancel_reindex |
| Application data | list_signals, list_report_definitions |
| Session recordings | list_session_recordings, get_session_recording |