Introduction

The Kadu MCP server is a remote Model Context Protocol server: connect Claude, ChatGPT, Claude Code or an IDE and use Kadu through conversation — list tasks, run an execution, follow events and logs, resolve pending items, configure environments, secrets, schedules and webhooks, sync the Playbook and check usage and cost. It offers the operations of the v1 API as tools the AI client calls. You connect it by URL; there is nothing to install.

It is served on its own host, mcp.kadu.ia.br, over Streamable HTTP in stateless mode, authenticated by a Bearer token issued by the Kobana Account: through the OAuth 2.1 flow, where the client gets only the URL and signs in on its own, or with a personal token created in the Kobana Account token wizard. No client certificate is involved.

When to use it

	v1 API	MCP server (this)
Consumer	your backend, an integration	an AI client (Claude, ChatGPT, Claude Code, an IDE)
Setup	token, out of band	a URL
Transport	HTTPS/REST	Streamable HTTP (JSON-RPC 2.0)
Authentication	Bearer token issued for the API	OAuth 2.1 or personal token, always issued for the MCP
Surface	the /v1 routes	one tool per /v1 operation

The MCP server does not replace the API. Each tool dispatches in-process to the route handler that implements the operation, so validation, filters, the execution queue, the contracted plan, the cost limit and organization isolation are exactly the same. If you are writing code, use the v1 API. If you are connecting an assistant, use this.

The principle

A capability exists in the MCP only if it exists in the v1 API.

Nothing is implemented twice. The tool calls the route handler with the identity the caller's token has already proven — the same person, the same organization — so it runs exactly as it would for any HTTP request. A tool does what the route does — never more.

In practice, the MCP reaches what the Agent Console reaches, because every console action has an API route. Left out is only what, by definition, belongs to the person in the browser: sign-in and switching organizations, onboarding, connecting the Playbook through the GitHub App, and deciding an approval — see Confirming destructive tools.

What you see is narrower than the catalog

tools/list returns only the tools this caller can run: those the token's scope reaches and the person's role allows in the organization. An assistant is not told about capabilities that would only be refused. The rules are in Authentication.

Getting started

1. Point your client at the server URL — see Endpoints and Clients.

2. Authorize. The client opens the Kobana Account sign-in; sign in with an account of the organization and choose, on the consent screen, what the assistant can do. See Authentication.

3. List the tools to confirm what your access reaches — ask the assistant, or, with a token issued for the MCP at hand:

   curl https://mcp.kadu.ia.br/ \
     -H "Authorization: Bearer $MCP_TOKEN" \
     -H "Content-Type: application/json" \
     -H "Accept: application/json" \
     -H "MCP-Protocol-Version: 2025-06-18" \
     -d '{ "jsonrpc": "2.0", "id": 1, "method": "tools/list" }'

4. Explore the docs — the full catalog is in Tools.

:::caution What comes from an execution is data, not instructions Events, logs, memories and pending items carry text the agent wrote from third-party data (bank statements, ERP records, e-mails). The server tells the assistant not to follow directions found there and to confirm with you before any action a result appears to ask for. :::

Next steps

• Authentication — the OAuth flow, the personal token, the scope and permissions applied, and the failure modes.
• Endpoints — URLs per environment and the routes served.
• Transport — JSON-RPC, protocol versions, headers and methods.
• Resources and prompts — documents by URI, ready-made scripts, autocomplete and the confirmation of destructive tools.
• Clients — how to connect Claude Code and file-configured clients.
• Rate Limiting — the per-person budget.
• Listing, Sorting and Filters — cursor, limit, sort_by and the filters.
• Idempotency — idempotency_key on writes.
• Errors — the two failure channels, and why the distinction matters.
• Tools — the tool catalog.