MCP — AI agent access

Whitesmith exposes your account to AI agents over the Model Context Protocol. An agent with your token can operate the same REST API you use in the dashboard — patterns, mailshots, sequences, webhooks, integrations — with exactly your permissions.

1. Create a personal token

Tokens are created in the dashboard and shown only once: Settings → MCP Tokens. A token inherits your live permissions and can be revoked at any time.

2. Configure your client

Replace <YOUR_TOKEN> with the token from step 1. The same mcp.json works for pi, Cursor, Claude Desktop and any other MCP client.

Connect an AI agent (MCP)

Endpoint: https://whitesmith.ru/api/mcp

You need a personal token — create one in Settings → MCP Tokens. Full guide: whitesmith.ru/mcp

pi (pi coding agent)

pi mcp add whitesmith-org --url https://whitesmith.ru/api/mcp --header "Authorization=Bearer <YOUR_TOKEN>"

Claude Code

claude mcp add --transport http whitesmith-org https://whitesmith.ru/api/mcp --header "Authorization: Bearer <YOUR_TOKEN>"

mcp.json — Cursor, pi, any MCP client

{
  "mcpServers": {
    "whitesmith-org": {
      "url": "https://whitesmith.ru/api/mcp",
      "headers": {
        "Authorization": "Bearer <YOUR_TOKEN>"
      }
    }
  }
}

Replace <YOUR_TOKEN> after downloading.

What agents get

list_endpoints — every REST endpoint the token may call, with RBAC requirements
api_call — call any of those endpoints (method, path, body); each call runs the real permission stack
describe_entity — field structure of any model, for composing request bodies
Sugar tools: org settings get/set, integration account rotation, webhook test-fire, sequence run

Superadmin scope

Platform administrators get a separate scope at /api/superadmin/mcp with organization overview/approval, DNS zone management and MTA status tools. Create its tokens on the superadmin MCP page. The two scopes are fully isolated: an org token can never reach superadmin routes, and vice versa.

Security notes

Tokens are bearer secrets — store them like passwords
Every agent call carries your permissions at call time; revoking the token cuts access immediately
Token activity (creation, last use) is visible on the token page