MCP And Developer Access
Connect coding agents to version-aware Archflow tools
Archflow exposes a Streamable HTTP MCP endpoint for compatible coding agents. Choose the narrowest credential scope and access level that fits the task.
Credential Options
| Credential | Location | Scope |
|---|---|---|
| Project MCP key | Project Settings → MCP/API | One project; read-only or write-enabled |
| Account token | Global Settings → Developer tools | Projects accessible to the account; expires after 30 days |
| Browser OAuth | Offered by compatible MCP clients | Account authorization without manually pasting a long-lived key |
Availability can depend on plan and project role.
Connect A Project
- Open Project Settings → MCP/API.
- Create a named key and leave Write Access off unless the agent must change the model.
- Copy the key immediately; it is shown only once.
- Use the generated Claude Code, Cursor, or generic-client configuration.
- Restart or reconnect the client and inspect the exposed tools.
The generated configuration contains the correct endpoint and bearer-token format. Do not commit the token to source control.
Project keys can be disabled, re-enabled, rotated, or deleted. Rotation immediately invalidates the old value.
Account-Wide Access
Use an account token when one client needs to discover and work across several projects. The token grants the client the same project visibility as the account, so store it more carefully than a single-project key and revoke it when the client is no longer used.
Prefer browser OAuth when your client supports the Archflow authorization flow and interactive login is practical.
Tool Boundaries
MCP tools are version-aware. Inspect the active project version and stable resource IDs before writing. Project IDs are injected for project-scoped keys; do not invent or copy IDs between projects or versions.
Read tools cover project structure, relationships, workflows, documentation, analysis evidence, knowledge, and supported model surfaces. Write-enabled connections can use supported creation and update tools. Destructive MCP-only operations require an explicit confirmation argument.
Architecture Simulations use optimistic revision checks. On a revision conflict, inspect the returned latest revision before continuing.
Recommended Skills Bundle
The project settings page provides a bundle containing:
archflow-onboardfor first-time discovery and modelingarchflow-syncfor recurring architecture drift reviewarchflow-best-practicesfor modeling and evidence conventions
Install the current bundle shown in Archflow rather than reusing an older downloaded copy.
Safe Operating Practices
- Begin read-only and enable writes for a defined task.
- Inspect before updating, and reuse returned stable IDs.
- Keep product-facing names human-readable; put code paths in descriptions or evidence.
- Review the active version before every mutation.
- Rotate exposed keys and disable unused ones.
- Treat generated Architecture Documents and simulations as reviewable work, not automatic truth.