One MCP contract, three gateway tools.

Use one stateless Streamable HTTP MCP contract to inspect the catalog, execute code-mode workflows, and resume approved programs.

Choose the transport

Send MCP JSON-RPC directly to the stateless gateway. Use an execute-scoped bearer key when authentication is enabled. The path uses the organization's immutable ID, so display-name and slug changes do not invalidate configured clients.

{
  "mcpServers": {
    "controller": {
      "url": "https://controller.example.com/orgs/org_0123456789abcdef0123456789abcdef/mcp",
      "headers": {
        "Authorization": "Bearer <execute-api-key>"
      }
    }
  }
}

Three tools, one gateway

The agent sees a compact gateway instead of one MCP definition for every connected operation.

skills

Inspect available catalog tools and schemas without invoking them.

execute

Run TypeScript that searches, describes, and calls connected tools.

resume

Continue an execution after its pending call is approved.

Stateless by contract

  • * POST /orgs/:organizationId/mcp carries MCP JSON-RPC.
  • * OPTIONS /orgs/:organizationId/mcp handles browser preflight.
  • * Notification-only requests receive 202.
  • * GET and DELETE return 405.
  • * The endpoint does not issue an Mcp-Session-Id.

Connect to /orgs/:organizationId/mcp/toolkits/:toolkitSlug to restrict discovery and invocation to a toolkit's connections. The MCP contract remains the same.

Approval is a resumable state

01

Execute

The runtime reaches a catalog call that requires approval.

02

Checkpoint

Controller persists the execution ID, resume token, and pending call.

03

Decide

An authorized operator approves or declines the exact call.

04

Resume

The program continues without repeating calls it already completed.