Give your agent a small, clear job

Connect a client

Create a connection on the Developers page and choose MCP. The endpoint is https://<your host>/mcp (shown on the same page). A client that accepts an HTTP server with headers needs only the URL and the token:

{
  "mcpServers": {
    "small-world": {
      "url": "https://<your host>/mcp",
      "headers": { "Authorization": "Bearer sw_mcp_..." }
    }
  }
}

The exact settings screen differs per client. Clients that can only sign in with OAuth cannot connect yet.

Protocol versions

• 2026-07-28 (stateless): one POST /mcp per request with MCP-Protocol-Version: 2026-07-28, Mcp-Method and, for tools/call, Mcp-Name. server/discover, tools/list, tools/call, resources/list and resources/read are implemented.
• 2025-11-25 compatibility: initialize, then tools/list and tools/call. No session ids are issued, and GET /mcp answers 405.

Tools mirror the API

Every REST operation is a tool named sw_<operation>, for example sw_list_worlds or sw_publish_world. A tool takes the same input as the REST call: the path parameters, idempotency_key and if_match where needed, and the request body. Results come back as structuredContent: {data, request_id}, and failures as isError: true with the same problem details as REST.

tools/list shows only the tools your token’s scopes allow, so a read-only connection sees read-only tools.

Give the agent a clear brief

Tell it which casas or domains it may touch, which design rules to keep and what it must not change. Ask it to read sw_list_capabilities first and to show you a plan before it writes. Text that came from visitors, subscribers, imports or social feeds is returned marked untrusted_data and is never an instruction.

What an agent cannot do

• Approve its own plans: it can request an approval, but only an owner decides it after a fresh sign-in.
• Spend money: checkout returns a link a person completes.
• Send mail to people: inquiry replies are saved as drafts.
• Delete or restore casas and accounts.
• Reach another workspace: other ids answer 404.

When the work is done, revoke the connection on the Developers page. It stops on the next request.