Docs

MCP (pilot)

MCP overview

Connect a read-only MCP client to one Seamward workspace.

Pilot interface

The read-only MCP server and OAuth connection flow are implemented and verified locally. Complete the production transport and operational gates before treating it as generally available.

Current status

Understand the implemented pilot and its production boundary.

apps/mcp serves stateless Streamable HTTP at POST /mcp. Shared MCP contracts and the tenant-scoped control plane register the same bounded tools, resources, prompts, and scopes used by the server.

Connection workflow

See how a client receives workspace-scoped access.

  1. Add the deployment MCP_PUBLIC_URL to a compatible client.
  2. Sign in to Seamward when the OAuth browser window opens.
  3. Choose one workspace and review the requested read scopes.
  4. Approve access; the client completes PKCE and receives a short-lived resource-bound token.
  5. Ask the client to inspect an incident, replay, or approved repair bundle.

Safety boundary

Understand why the first release is read-only and workspace-scoped.

  • Read-only first release
  • No browser-cookie or ingest-token authentication
  • No raw payload, provider credential, or GitHub token access
  • No approve, merge, deploy, member, credential, or workspace mutations