MCP endpoint scopes
Use these technical references to select an endpoint or diagnose a scope mismatch. A bound listener gets its workspace or application from deployment configuration. The application router takes stable scope IDs from the authorized caller. Start with MCP tool discovery on the exact endpoint, then inspect the function catalog for its scope and your current grants.
Choose the entry point
- For a new deployment, provision a workspace through the Platform endpoint, then create its first application through the bound Workspace endpoint.
- For everyday application work, use the Router endpoint to list and select an accessible application. Use the Application endpoint if your operator has provided a listener dedicated to that application.
- For a governed workspace reset, assess and prepare on the Workspace endpoint. The separately authorized apply operation uses the dedicated Reset Apply endpoint.
These V2 listener contracts were reviewed on 6 November 2026. See Request paths for transport and Installation overview for distribution availability. The MCP Client section organizes the tools by what you want to do.
In this section
- Platform endpointDiscover platform operator functions for workspace provisioning and native identity operations.
- Workspace endpointOperate within the bound workspace, including first application creation.
- Application endpointRun permitted typed work against one preselected application.
- Router endpointList accessible applications and route requests with explicit workspace and application IDs.
- Reset Apply endpointReview the separately guarded listener for applying an exact approved workspace reset.