Skip to docs content
Apito MCP agent workflow
Free Cloud
Pro
Updated 2026-10-18

Apito MCP agent workflow

Editions: Free Cloud · Pro

Apito MCP exposes agent tools over system GraphQL (schema design, tenants, users, probes) plus helpers that map/probe public GraphQL. Agents stage drafts; they never publish schema.

What MCP is for

  • Propose models/fields and stage drafts for review
  • Inspect schema diffs / change plans
  • Platform catalogs (tenants, users) with correct auth
  • Probe public documents after publish

What MCP is not

  • A replacement for Console Publish
  • An Admin SDK for app CRUD (use JS / Go / Flutter)
  • A way to bypass RBAC on secured APIs

Blueprint companion

The mcp-saas pack shows a shared SaaS schema authored with MCP-style prompts, then synced via CLI for repeatability.

Connect

The client config is a URL. It does not contain an access token. Each name under mcpServers is a separate connection.

Where the engine runs MCP URL Approval page
Apito Cloud https://api.apito.io/mcp https://app.apito.io/mcp
Studio on this machine http://localhost:4055/mcp http://localhost:4055/mcp
Engine process without Studio http://127.0.0.1:5050/mcp the console origin, often http://localhost:4000/mcp
Udbhabon Studio https://engine.udbhabon.com/mcp https://engine.udbhabon.com/admin/
Another Apito-compatible host https://<host>/mcp that host’s console

Use the URL the engine advertises. A direct engine on port 5050 is not the same resource as Studio on port 4055.

1. Add the server

In ~/.cursor/mcp.json, or in the project’s .cursor/mcp.json:

{
  "mcpServers": {
    "apito-cloud": { "url": "https://api.apito.io/mcp" },
    "apito-local": { "url": "http://localhost:4055/mcp" },
    "apito-udbhabon": { "url": "https://engine.udbhabon.com/mcp" }
  }
}

Reload MCP servers in Cursor. Do not set command, env, or an Authorization header for these entries.

2. Let the client discover OAuth

The first request to /mcp returns 401 and a WWW-Authenticate header. Cursor reads /.well-known/oauth-protected-resource/mcp and /.well-known/oauth-authorization-server, registers a public client, and starts authorization-code with S256 PKCE.

3. Approve in the Console

The browser opens /mcp?request_id=… on the console origin. Sign in if the page asks. The form is the existing access-token form, locked to the MCP assistant preset.

  1. Choose the projects this connection may use.
  2. Choose the tenant scope.
  3. Click Give MCP access.

The engine mints the operator grant and keeps it on the server. The browser returns to Cursor at http://localhost:8787/callback with a one-time code. Cursor exchanges that code and stores the resource-bound credential in its own secret storage. The token is not written back into mcp.json.

4. Call a tool

Ask the agent to list models in one approved project. Reads use the grant from approval. Writes also need a project scope lease from prepare_project_scope and confirm_project_scope. Schema publish stays in the Console.

What not to put in the config

  • An apt_ access token
  • A project ak_ key
  • APITO_API_KEY or APITO_GRAPHQL_ENDPOINT
  • A command that launches the old apito-mcp package

/mcp rejects an apt_ bearer. Project ak_ keys belong on secured GraphQL only — System vs secured.

The apito-mcp npm package is deprecated. It no longer serves tools. apito mcp serve can still launch that Node runtime for older stdio setups. apito mcp serve --transport http bridges stdio to the URL above. APITO_MCP_RUNTIME=node keeps the Node runtime.

Next

PreviousWebhooks · GitLabNextPlugins