AI and integrations

MCP server

Connect AI clients to your organization's knowledge, agents and connectors over the Model Context Protocol.

Endpoint

https://mcp.dev.gov.vin/mcp

The server speaks the Streamable HTTP transport, statelessly: each request is handled on its own, with no session, and answered with a JSON response rather than an event stream. It's the programmatic interface for organizations.

Authenticate

Send an MCP key as a bearer token, or sign in with OAuth:

Authorization: Bearer si_mcp_…

Owners and admins create MCP keys at https://id.dev.gov.vin → organization → Keys, type MCP client (Keys). The key's scopes decide which tools the server offers. Without a valid key (missing, unknown, revoked, expired or not an MCP key) the server answers 401 with a JSON-RPC error and WWW-Authenticate: Bearer realm="mcp", resource_metadata="…" (see below).

Clients that support MCP authorization can sign in with your account instead of a key. Add the server URL without a header; the client finds out where to sign in from the 401:

WWW-Authenticate: Bearer resource_metadata="https://mcp.dev.gov.vin/.well-known/oauth-protected-resource/mcp" points to this server's metadata (RFC 9728), which names https://id.dev.gov.vin as its authorization server.
The client registers itself at https://id.dev.gov.vin/oauth/register (dynamic client registration, public clients with PKCE) and opens the sign-in page.
You choose the organization (one where your role can connect MCP clients: developer and above) and the permissions the client gets, from the scopes you hold there. Read scopes are preselected.

The client then sends access tokens issued for this server (1 hour, renewed with a refresh token). Role changes apply at the next renewal; remove the client on your account page under Connected apps to end its access. Tools act as you: changes they make are recorded in the audit log with you as the actor.

Connect a client

claude mcp add --transport http si https://mcp.dev.gov.vin/mcp --header "Authorization: Bearer $SI_MCP_KEY"

For clients configured with an mcpServers file, such as .mcp.json:

.mcp.json

{
  "mcpServers": {
    "si": {
      "type": "http",
      "url": "https://mcp.dev.gov.vin/mcp",
      "headers": { "Authorization": "Bearer ${SI_MCP_KEY}" }
    }
  }
}

curl -s https://mcp.dev.gov.vin/mcp \
  -H "Authorization: Bearer $SI_MCP_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

Tools

Every key gets whoami; the others need the scope shown. Arguments and details are on MCP tools.

Tool	Scope	Description
`whoami`	none	Identity and scopes of the current key.
`context_get`	`knowledge:read`	Read a context entry by namespace and key.
`context_list`	`knowledge:read`	List context entries in a namespace, optionally filtered by key prefix.
`pages_list`	`knowledge:read`	List knowledge base pages under a parent (default: top level).
`page_get`	`knowledge:read`	Read a knowledge base page as Markdown with front matter (title, version, ...).
`page_search`	`knowledge:read`	Search knowledge base pages by title and text.
`context_put`	`knowledge:write`	Create or replace a context entry.
`context_delete`	`knowledge:write`	Delete a context entry.
`page_upsert`	`knowledge:write`	Create a knowledge base page from Markdown, or replace an existing page's content.
`agent_job_create`	`agents:run`	Queue work for one of the organization's self-hosted agents.
`agent_job_cancel`	`agents:run`	Cancel an agent job: a queued job is canceled at once; a running job stops at its device's next check (status canceling, then canceled).
`agent_job_get`	`agents:read`	Status of an agent job, with a temporary results URL once done.
`connectors_list`	`connectors:read`	Remote MCP servers connected to this organization and the tool names they add here.

Keys with connectors:read also get the tools of the organization's enabled connectors, named <slug>__<tool>.

Activity

Tools that change data (context_put, context_delete, page_upsert, agent_job_create) are recorded in the audit log with the key as the actor. Requests time out after 60 seconds.