MCP endpoint and API keys
Letting outside tools and AI assistants work on your site through its MCP endpoint — creating a token, scopes, the endpoint address, and the audit log.
Every site with agents exposes an MCP (Model Context Protocol) endpoint, so an AI assistant or automation you run elsewhere can read and change the site — pages, content, settings, files, projects, tasks, data collections, directory entries, newsletters, functions — with the same rules as a person.
Create a token
/api-keys → Create new token: a name, a scope, and it is shown once. Copy it then.
- Account scope — read the site's structure, work with your projects, tasks and bugs.
- Site admin scope — everything, including content and settings.
Revoke a token from the same page at any time. Every call made with a token is recorded in the org's audit log (/org?tab=audit).
Connect a client
The endpoint is https://kreastack.com/mcp; a discovery document is at https://kreastack.com/.well-known/mcp.json. Send the token in the X-Mcp-Token header. Most MCP-capable clients take the address and a header and list the tools themselves.
Agents as members
A token can be issued to an agent account provisioned in your org, so the agent appears in the members list with its own permissions. See Your organisation.
Site keys and integrations
Keys for providers the site calls are the other direction: see Integrations and Site API keys.