Agents

MCP integration

Model Context Protocol as a canonical projection over the same API surface as REST, GraphQL, and SDKs — never a second authority.

MCPMCP referenceJSON-RPC methods, resource metadata, token model, tools, resources, prompts, errors, and observability.BindingsExposure bindingsThe shared projection model that binds MCP, REST, GraphQL, gRPC, SDKs, CLI, dashboards, and Runtime Fabric scaling vocabulary.AuthAuthentication referenceBearer tokens, API keys, scopes, project grants, policy evaluation, sessions, and authorization envelopes.

MCP — the Model Context Protocol — lets external IDEs, AI assistants, and other agents discover and invoke your project's capabilities. In Vadyl, MCP is a canonical projection over the same operation dispatcher as REST, GraphQL, gRPC, and the SDK — never a second source of truth.

What gets exposed

Anything in the project's capability surface that's explicitly opted in via project capability grants:

Entity read / write operations
Workflow start / signal
Agent runs
Governed connection operations
Custom handler invocations
Analytics report execution

Configure MCP

// vadyl.config.ts
mcp: {
  enabled: true,
  endpoint: "/mcp",                 // route on your project's API host
  exposures: [
    {
      name: "support-toolkit",
      tools: [
        "entityRead:Customer",
        "entityRead:Order",
        "entityWrite:RefundRequest",
        "agent:SupportAgent.run",
        "workflow:processRefund.start",
      ],
      auth: { kind: "oauth2", scopes: ["mcp:support-toolkit"] },
    },
  ],
},

tools/list

MCP's tools/list returns only operations granted to the calling client's capability set. Filtered byProjectCapabilityGrant exactly the same way the dashboard, SDK, and CLI surface available operations. There is no MCP-only escape hatch.

tools/call dispatch

tools/call dispatches through the same IApiOperationDispatcher as REST and SDK. The same access engine evaluates the call. The same observability fires. The same billing accumulates. The same explainability records the decision.

RFC 9728 OAuth

Vadyl publishes OAuth Authorization Server Metadata at /mcp/.well-known/oauth-authorization-server per RFC 9728 so MCP clients can auto-discover the auth flow. Tokens are scoped to the exposure and bound to the project resource.

Client integration

Any MCP-compatible client connects with the project's endpoint + OAuth discovery. Examples: Claude Desktop, Cursor, VS Code Agent, Continue, custom agents. Once connected, the client sees the granted tools and can invoke them through the standard MCP RPC.

Why this matters

MCP is the lingua franca for AI clients today. By projecting your Vadyl capabilities through MCP — without making MCP a separate authority — you get instant compatibility with every MCP-aware tool in the ecosystem, while keeping the same governance, auth, and audit model that protects every other surface.

Memory

Token accounting