Agents and MCP

makermap is built so that anything you can do in the app, an agent can do as a tool - not a subset chosen for an integration, and not a second API written later. The screens and the tools call the same services, so a capability cannot exist on one side and be missing on the other.

Connecting

The server speaks the Model Context Protocol over HTTP, statelessly, at /api/mcp. Authentication is a personal access token in an Authorization: Bearer header. See Connect an agent for the ten-line version.

What a token decides

A token carries scopes - products:read, decisions:write, infra:read and so on. Scopes do two things:

1. They gate calls. A tool whose scope you do not hold is refused.
2. They gate discovery. tools/list only returns tools the calling token can actually use, so an agent never sees a capability it cannot reach. Being refused is the fallback; not being offered is the mechanism.

Grant the narrowest set that does the job. A read-only agent with products:read is a genuinely different thing from one that can also write.

What no token can grant

Some acts are protected: an agent principal is refused them regardless of scope. Creating workspaces or organizations, inviting members, registering agents, resolving decisions, and every hard delete. These are on a deny-list rather than behind a scope precisely because a scope can be granted by accident, and because a few of them are how a narrowed token would escape its own narrowing.

Autonomy

Beyond that, each agent has an autonomy level that further narrows what it may do, and an assignment can record the expectations and bounds for a specific piece of work. An assignment's bounds are a recorded ceiling for that work, not a grant - the real ceiling is still the agent's policy.

One call to hand over everything

get_product_context returns a product's whole working picture in one call: the why fields, the current stage, open decisions, the board, recent activity, knowledge, links and more - budgeted so it fits a context window, with an opaque revision marker you can pass back to get only what changed since. It is the call to make at the start of a session, instead of fifteen.