Platform MCP Quickstart

Platform MCP lets trusted AI clients inspect and manage Kravos.ai through the Model Context Protocol.

Use it when an operator or internal agent needs to work across agents, sources, conversations, skills, tools, usage, and org settings from an MCP-capable client.

What You Need

Choose OAuth Or An Org API Key

Quick OAuth Setup

1. Sign in to Kravos.ai in the same browser your MCP client will use.

2. Add a remote MCP server in the client with this URL:

   https://mcp.kravos.ai/api/v1
   

3. Approve the Kravos.ai consent screen when the client opens it. The client discovers the OAuth details automatically.

4. Start with read scopes such as read or docs:read agents:read sources:read.

5. Confirm the connection in MCP Connections → OAuth Connections.

You do not need to configure a .well-known URL. It is an advanced OAuth discovery endpoint for MCP client developers. See MCP OAuth Setup if you are building a custom client.

OAuth access tokens expire after 1 hour. Refresh tokens rotate and are valid for up to 30 days while the connection remains active.

Quick Org API Key Setup

1. Go to MCP Connections → Org API Keys.

2. Click Create key.

3. Pick a permission preset.

4. Leave destructive permissions off unless the automation must delete, revoke, deactivate, or archive data.

5. Copy the raw sk_org_... key immediately. Kravos.ai only shows it once.

6. Configure the MCP client with either header:

   Authorization: Bearer sk_org_...
   

   or:

   x-api-key: sk_org_...
   

First Tool Calls To Try

Start with docs and read-only inventory tools:

list_docs
list_mcp_tool_docs
get_organization
list_agents
list_sources
search_knowledge_base

Each tool still needs its matching permission. For example, search_knowledge_base needs retrieval:read.

Tool Catalog

Use list_mcp_tool_docs before giving an MCP client broad instructions. Each entry is generated from the MCP server definitions and includes the tool name, description, required permission, destructive flag, input schema, safe input example, safe output example, source path, and last-updated time.

Use get_mcp_tool_doc when you know the exact tool name and need one focused contract. For example, fetch search_knowledge_base before asking a client to debug retrieval, or fetch create_api_key before building service-user automation.

Then test a safe runtime path:

test_agent
chat_playground

Use write tools only after you know which agent or resource the client can change.

How Access Is Enforced

Every tool call goes through three checks:

1. Authentication — OAuth bearer token, x-api-key, or API key bearer token.
2. Permission — for example, sources:write for create_source.
3. Resource grant — whether the caller can target the specific agent, source, user, or other resource ID.

Denied calls return an MCP tool error instead of leaking internal details. Denied, failed, successful, and destructive calls are written to audit logs when logging succeeds.

Related Docs