Agents & MCP
Agents work through the same security boundary as people.
Every edit is an API call. Your agents get purpose-built MCP workflows.
Glattice ships a remote Model Context Protocol server secured by OAuth 2.1. Its focused tools invoke the registered REST application under the identity and permissions of the person who authorized the client. Postgres row-level security applies to reads and writes; each board-data write is attributed in history.
The endpoint
Add this as a remote MCP server in any MCP-compatible client. You will be sent to a browser consent screen, and the client gets a credential bound to the MCP resource and your account.
https://mcp.glattice.app/mcpAuthorization is OAuth 2.1 with PKCE, discovered via RFC 9728. Protocol version 2026-07-28, with the older revisions still available there for existing clients.
What an agent can actually do
MCP tools execute inside Glattice under the authenticated user's RLS-scoped client. Public MCP credentials are resource-bound and stay at the MCP boundary; internal calls carry trusted request-local identity, never a service credential. (`check_write_access` reads no board data: it answers “may I write here?” from the permission predicates the API uses.)
A tool badged write changes shared board data, and needs the target space on Pro or Team. Reading is available on every plan.
Getting oriented
Where am I, what can I reach, and what am I allowed to change?
- search_spaces
- List the spaces you can reach.
- search_lattices
- Search or list boards in a space.
- check_write_access
- Ask "may I write here?" before spending a step.
- get_space_usage
- AI quota and rate-limit configuration for a space.
Working with your boards
Boards, facets, facet values, cards, and the assignments that connect them — available through agent-focused MCP workflows backed by registered REST handlers and shared RLS permission checks.
- read_lattice_structure
- A board's full schema — facets and their values.
- search_cards
- Search or list cards, with their facet assignments.
- read_facets
- List the reusable facets in a space, and where they are attached.
- write_lattice_structurewrite
- Create and update boards, facets and facet values.
- write_cardswrite
- Create, update, move, soft-delete and bulk-edit cards; set or clear dates.
- write_facetswrite
- Create, update and delete reusable facets.
- write_facet_lifecyclewrite
- Promote or reduce a facet's scope, and attach it to a board.
- generate_complete_latticewrite
- Build a whole board — facets, values, cards, assignments, dates — in one transaction.
Working alongside your team
Comments on the card itself, the change history behind it, and the notification inbox that tells you an agent has been at work.
- read_comments
- A card's comment thread.
- write_commentswrite
- Add, edit or remove a card comment.
- read_lattice_history
- The audit trail — who changed what, from which interface, with before-and-after values.
- list_notifications
- Your notification inbox.
- get_unread_count
- Your unread count.
- get_notification_preferences
- Your effective notification preferences.
- mark_notifications_read
- Mark your notifications read.
- manage_notification_subscription
- Watch or mute a board.
Staying in control
- Read is free; writes are gated
- Any account can read over MCP and REST. A write is refused unless the target space is on Pro or Team, and unless your role in that space allows it — checked before the tool runs, using the same database predicates the API uses.
- Board-data writes identify their source
- The board's change history records the interface behind each write — the browser, the REST API, MCP, or the built-in AI bar — alongside who did it. A multi-step agent run is grouped by correlation id, so it reads back as one episode rather than forty rows.
- You watch it happen
- An agent's writes land on your board while you are looking at it — no reload, no polling. Live sync and agent writes are gated on the same plans, so any space an agent can write to is already streaming. They also raise their own notification category: you are not muted from your own agent the way you are from your own clicks.
- Metered, server-side
- 1,000 API requests and 120 MCP requests a minute, plus a per-space monthly AI budget. Limits return 429 with Retry-After, not a surprise invoice.
Three things you can do today
1.Build a board from a prompt
search_spaces, then generate_complete_lattice with a full definition — facets, values, cards, assignments and dates — persisted in one transaction. It is the same bulk path the template picker uses.
2.Triage and move work
read_lattice_structure maps "the Blocked column" to a real facet value id, search_cards finds the card, and write_cards updates its facet values. Assigning facet values is the move primitive — there is no separate move call.
3.Turn a board into a timeline
Create a date facet with rangeEnabled, set a start and end per card, then read_lattice_history to see the whole run attributed to your agent.
Read the reference, then connect.
Every public endpoint carries a description and worked examples, rendered live against the running spec.