Driving your install from your own AI client
What the MCP endpoint is, what a key can do, and where the boundary actually sits.
Zephyr exposes a governed MCP endpoint. Point Claude — or anything that speaks MCP — at it and ask for work in words.
Where the boundary is
A key acts as its owner and can never exceed them. The actor becomes that staff user, and every tool declares a permission that is checked per call. A key minted by somebody who cannot refund an invoice cannot refund an invoice.
A key may also be narrower than its owner: permission slugs on the key intersect with the owner’s, so "pages and products only" is a real restriction rather than a label. A key with no slugs is as capable as its owner — and the admin says so in as many words when it mints one.
Revoking a key takes effect immediately.
What it can do
- Read invoices, tickets, clients, services, servers, leads and the catalogue.
- Write pages, navigation, blog posts, knowledge-base articles and catalogue products.
- Answer with identifiers alongside the facts, so you can click through and check it.
Money and destructive actions are human-gated through an approval queue rather than executed directly.
Two rules worth knowing
The block vocabulary is served, never guessed. An agent asks what blocks this install supports and gets the same list the renderer switches on, so it cannot invent a block type and watch it vanish at render.
Prices are quoted, not invented. The catalogue tool returns your real cycles, so copy quotes your actual prices.
Rate limits
Per key, per minute. Going over returns a 429 rather than an opaque failure, so a client can back off properly.