Connect an AI agent over MCP

AI agents are only useful in your business if you can trust them with it. Routario speaks MCP (the Model Context Protocol), the open standard for connecting AI agents to tools and data — so any spec-compliant agent, whether it’s Claude, ChatGPT, or one you build yourself, can work with your workspace.

The difference is what the agent is allowed to do. Every agent connects through a key that:

starts with zero access — a fresh key can reach nothing until you grant it;
can propose work but never make it live on its own — a person stays in the loop;
can read only a short, named set of things — never crawl your contacts, invoices, or deals.

Governed agent access is built in, not a paid control surface bolted on top.

What you get

A single endpoint —

https://<your-workspace>.routario.com/mcp

— that any MCP client can connect to with a bearer token. Once connected, the agent discovers exactly the tools its key is granted, and nothing else.

Why it’s safe by design

This is the part that matters, so it comes first.

1. Keys start closed. A brand-new key authenticates but can touch nothing. You grant exactly the areas it needs — “draft automations,” “read run status” — and it gets those and only those. This is the same access list your people, agents, and field devices are on; see Access: who can do what.

2. It can propose, but not deploy. The one tool that builds something — build — only ever produces a draft. It reads what your workspace can do, proposes the flows and agents to meet a goal, and stages them switched off. Nothing runs. A person reviews and confirms each piece in the app. Turning a flow live is a separate tool, arm, gated behind an Execute grant that no key holds by default — so going live is deliberately a human’s decision unless you explicitly grant it.

3. Reads are a short allowlist, not a crawl. The read tools let an agent monitor the automation layer — what flows exist, which runs happened and how they finished. There is no broad “list all contacts / invoices / deals” tool. That breadth would be an exfiltration risk, so it simply isn’t on the menu. A key sees the same scope your existing API exposes, nothing wider.

4. Discovery doesn’t leak. When a client asks the endpoint which tools are available, it only ever sees the tools its own key is granted. A read-only key never even learns that a make-live tool exists.

Connect an agent

Two ways in. One-click sign-in is simplest for an off-the-shelf agent like Claude or ChatGPT; a scoped developer key (the numbered steps below) suits scripts, self-hosted installs, and CI.

One-click: “Log in with Routario”

Add Routario to your agent as a remote (custom) MCP connector, using the branded endpoint:

https://mcp.routario.com/mcp

Your client runs the standard OAuth sign-in: it asks which workspace you’re connecting, sends you to Routario to log in, and shows a consent screen listing exactly what the agent is asking for. Approve it and you’re connected — with no token to copy or store. What you approve follows the same grant model as everywhere else: by default the agent can draft and monitor, never make anything live.

A scoped developer key

Prefer to pin the exact scopes, or connecting a script or a self-hosted install? Mint a bearer key instead.

1. Mint a scoped key

Each key carries a set of scopes in the form <type>:<id>:<actions>. Repeat the --scope flag to add more:

routario apikey mint "Acme ops agent" \
  --scope module:meta_drafter:write \
  --scope run:*:read \
  --scope flow:*:read

That key can draft automations and monitor runs and flows — a sensible “propose and watch” agent. The token prints once — store it like a password; it’s never recoverable.

A key minted with no --scope flags authenticates but can do nothing — the default-deny baseline you saw above.

To let a key make flows live by itself, add --scope flow:*:execute. That’s the line you deliberately don’t cross unless you want the agent to go live without a human — for most setups, leave it off and confirm in the app instead.

2. Point your MCP client at the endpoint

Configure your agent’s MCP client with the workspace URL and the bearer token:

URL:    https://<your-workspace>.routario.com/mcp
Header: Authorization: Bearer <your-token>

The endpoint is a stateless JSON-RPC service — it implements the standard initialize, tools/list, and tools/call methods, so a compliant client needs no special handling.

3. Confirm it connects

You can verify the connection with the official MCP Inspector before wiring up a full agent:

npx @modelcontextprotocol/inspector --cli \
  https://<your-workspace>.routario.com/mcp \
  --header "Authorization: Bearer <your-token>" \
  --method tools/list

Routario’s endpoint handshakes, authenticates the bearer, and returns the grant-scoped tool list. Because it speaks the standard protocol, any spec-compliant MCP client can connect the same way.

The tools

Every tool is grant-gated. A read tool is satisfied by a read or a write grant (write includes read). A client only ever sees the tools its key permits.

Tool	What it does	Grant it needs
`build`	Describe a use-case in plain words → a draft plan of flows and agents. Asks clarifying questions; never deploys anything.	Write on `module:meta_drafter`
`get_plan`	Check a draft from `build` — whether a person has confirmed and armed each piece yet.	Read on `module:meta_drafter`
`list_runs`	Recent automation runs and their status.	Read on `run:*`
`get_run`	The status and progress of a single run.	Read on `run:*`
`list_flows`	Your automations — each with a one-line description of what it does and its trigger.	Read on `flow:*`
`arm`	Make a drafted flow live — the make-live boundary. Only arms flows the key’s owner drafted.	Execute on `flow:*` — held by no key by default

The build → get_plan → arm sequence is the whole loop: an agent proposes a draft, anyone can watch a person review it, and going live is a distinct, separately-granted step. Draft and make-live are never bundled — a key that can draft cannot, by that fact, deploy.

What to ask the agent

Once connected, talk to your agent in plain language — it maps your ask to the tools above. A few to try:

“What automations do I have, and what does each one do?” — lists your flows, each with a one-line description and its trigger.
“Did last night’s runs succeed? Show me anything that failed.” — pulls recent runs and drills into a failure.
“Draft an automation: when an invoice PDF arrives by email, pull out the total and post it to our #finance Slack channel — but don’t turn it on.” — returns a draft, staged off. Nothing runs until you review it in the app.
“What’s the status of that draft — has anyone armed it yet?” — checks whether each piece has been confirmed and made live.

Notice the shape: the agent can propose a whole automation and watch what’s running, but the moment of going live stays with a person in the app — unless you deliberately grant the execute scope.

The security posture, in short

A Routario MCP key is just another actor on your access list, checked the same way your people and agents are. It starts fully closed; it discovers only what it’s granted; it can draft but not deploy; its reads are a deliberately narrow window onto the automation layer rather than a door into your business data. That posture is the same in a self-hosted install and in managed hosting — it travels with the key, not the deployment.

Where to go next

Access: who can do what — the one access list every actor, human or machine, is checked against.
Give a teammate or agent the right access — the step-by-step for granting scopes in Settings → Access.
Using the Routario API — the REST side of connecting external systems to Routario.