Overview

Tribe Social exposes a Model Context Protocol (MCP) server so AI agents such as Claude Code, Claude Desktop and Claude.ai custom connectors can read and write platform data on behalf of an admin.

• Endpoint: POST https://<platform-host>/api/mcp
• Transport: Streamable HTTP, stateless (every request is authenticated and served independently; there is no session ID and GET /api/mcp answers 405 because no standalone SSE stream is offered)
• Authentication: dedicated MCP API keys generated by platform admins, never the dashboard JWT
• Scope: every call is limited to the platform of the admin who created the key

Who can use it

Only users with the admin role can generate keys, and a key stops working the moment its owner loses the admin role or the key is revoked. Keys are managed from Profile menu → MCP Setup (/dashboard/mcp-setup), which is only rendered for admins.

API keys

Property	Value
Format	tribe_mk_<userId>_<32 random bytes, base64url>
Storage	Only a SHA-256 hash is stored, on the owning user's additionalInfo.mcpKeys. The full key is shown once, at creation time.
Scope	read (list/get/search tools) or read_write (adds create/update/publish/delete tools)
Revocation	Per key, immediate, from the MCP Setup page or DELETE /api/mcp-keys/:id. Revoked entries stay listed for 30 days, then are pruned on the next key creation.

Send the key as a bearer token:

Authorization: Bearer tribe_mk_...

Clients that cannot set headers may append ?key=tribe_mk_... to the URL. The server moves the key into the Authorization header and strips it from the URL before the request is logged, so it never reaches access logs or error tracking. Prefer the header whenever the client supports it.

Limits and safety rails

• Platform isolation: every tool filters by the key owner's PlatformId. IDs from other platforms return "not found"; they cannot be read or written.
• Rate limit: 120 requests per minute per key by default (MCP_RATE_LIMIT_PER_MINUTE). Over the limit the server answers 429 with a JSON-RPC error and standard RateLimit-* headers.
• No admin escalation: update_user_role cannot grant admin, cannot change an existing admin, and cannot change the key owner.
• Deletes are real deletes: delete_content removes the row, its Storj files and the Firestore mirror, exactly like deleting from the dashboard.
• Read-only keys get a clear tool error (isError: true) when they call a write tool; nothing is changed.
• Mobile stays in sync: write tools push the same Firestore mirror records the dashboard does (content, groups, user memberships and roles); each write response reports mobileMirror.

Key management endpoints

All three require an admin dashboard session (JWT cookie or token header).

Method	Path	Body	Response
POST	/api/mcp-keys	{ "name": "My agent", "scope": "read" | "read_write" }	201 with { id, name, prefix, scope, createdAt, revokedAt, key }. key is returned only here. Unknown scopes fall back to read.
GET	/api/mcp-keys	–	The caller's keys, newest first, without hashes or raw keys
DELETE	/api/mcp-keys/:id	–	The revoked key; 404 if it does not exist or was already revoked

See Setup for client configuration and Tools for the full tool reference.