POST. | Purpose | Endpoint |
|---|---|
| MCP endpoint | POST /mcp |
| Authorization-server metadata (RFC 8414) | GET /.well-known/oauth-authorization-server |
| Protected-resource metadata (RFC 9728) | GET /.well-known/oauth-protected-resource |
| Dynamic client registration (RFC 7591) | POST /api/v1/oauth/register |
| Authorization (consent) endpoint | GET /api/v1/oauth/authorize |
The MCP server uses OAuth 2.1 with PKCE (code_challenge_methodS256) and the mcp scope. A compliant MCP client needs no manual configuration: when it first calls /mcp without a token it receives a 401 whose WWW-Authenticate header points at the protected-resource metadata, from which the client discovers the authorization server, registers itself, opens the in-app consent page, and exchanges the resulting authorization code (with its PKCE verifier) for a token. The issued token is an ordinary Stardraw JWT — the same kind described under Authentication — so the MCP server can only do what the signed-in user is permitted to do.
MCP must be enabled by an application administrator (it is off by default). Each tool the assistant sees is the intersection of the administrator’s allowed-tools list and the user’s own access rights, and every tool call is logged. The available tools include:
| Area | Tools |
|---|---|
| Projects & snapshots | list_projects, get_project, create_project, update_project, create_snapshot |
| Products & cables | search_products, list_project_products, add_product_to_project, list_cable_types |
| Views | list_views, get_view, create_view, list_view_items, show_views |
| Drawing & placing | place_product, create_view_text_item, create_view_rectangle_item, create_view_line_item, and more shape tools |
| Connections | list_item_anchors, mount_product, connect_products, create_view_connector |
| Editing items | move_view_item, set_text_content, set_view_item_stroke, set_view_item_fill, delete_view_item |
The show_views tool returns an interactive, tabbed drawing viewer (an MCP Apps UI widget) so an assistant can render a project’s views inline.