FlatRun can expose its assistant's full tool set over the Model Context Protocol. The assistant and an external MCP client become two front doors onto one tool set: whatever the assistant can do, an MCP client can do too, subject to the same authorization.
mcp.enabled. The change applies immediately, without restarting the agent.
The server is served at /api/mcp.
One Tool Set, Two Front Doors
The MCP server does not add a second set of capabilities. It presents the exact tools the assistant uses (reading deployments and logs, writing deployment files, running quick actions, controlling deployments, reading security events) so any MCP-compatible client, an IDE, a desktop app, or another agent, can drive the server.
Authentication and Permissions
Every MCP call is authenticated and runs as the calling actor. Each tool enforces the same checks it does for the assistant:
- Read tools require read access to the deployment they target.
- State-changing tools require write access and are refused while a deployment is in protected mode.
- A caller can do exactly what its permissions allow, and no more.
The transport is stateless streamable HTTP, so authorization is evaluated on every request rather than fixed when a session opens.