five-on-it / apps/mcp/src/api
apps/mcp/src/api
The platform API as the MCP server calls it: JSON over HTTP, as one signed-in creator. The MCP server has no rights of its own (TECHNICAL_SPECS §9.7): every call carries a session token, either the HTTP caller's, forwarded, or one it signs in for with an e-mail and a password (stdio, local development). It signs in on the first call and again when the API answers 401, so it may start before the API does.