MCP for AI agents

Every serving endpoint is also a Model Context Protocol server. An agent connected to it can discover and query governed metrics — and nothing else: there is no raw-SQL tool. The endpoint's release, exposure, API-key allow-list, on/off switch, rate limit and every access policy apply to each tool call.

Transport: Streamable HTTP (official ModelContextProtocol C# SDK, ADR-0016).
URL: {mcp host}/mcp/{endpoint-slug} — locally http://localhost:5090/mcp/{slug}.
Auth: an API key with the mcp:use scope (X-Api-Key header; a serving:query-only key gets 403), or an OIDC bearer token from the tenant's identity provider. Unauthenticated requests get 401 with a WWW-Authenticate: Bearer resource_metadata=… challenge, and /.well-known/oauth-protected-resource/mcp/{slug} names the identity provider (RFC 9728).

Tools and resources

Tool	Returns
`list_metrics(query?)`	Names, descriptions, certification, trust
`describe_metric(name)`	Definition, usable dimensions, glossary terms, owner, trust breakdown
`list_dimensions(metric?)`	Dimensions — only those that actually compile with the metric
`query_metrics(metrics, dimensions, filters, limit)`	Rows (1–1,000), trust and warnings, through the policy-enforced compiler
`search_glossary(q)`	Terms, synonyms and the assets they link to — only assets the caller may see
`explain_lineage(asset)`	Upstream and downstream, with consumer counts (never consumer names)

Resources: keel://catalog (the endpoint's catalog) and keel://glossary. Tool errors come back as isError text. MCP queries bypass the result cache and are logged in the query log as consumer mcp with the client's name.

Set up

Create a key in Settings › API keys with scope mcp:use (and allow it on the endpoint if the endpoint has a key allow-list). Then point your client at the endpoint.

Claude Code

bash

claude mcp add --transport http keel-sales http://localhost:5090/mcp/sales \
  --header "X-Api-Key: $KEEL_API_KEY"

Claude Desktop and other stdio-only clients

Clients that only launch local (stdio) servers can reach a remote server through a bridge such as mcp-remote. In claude_desktop_config.json:

json

{
  "mcpServers": {
    "keel-sales": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "http://localhost:5090/mcp/sales", "--header", "X-Api-Key:${KEEL_API_KEY}"],
      "env": { "KEEL_API_KEY": "keel_live_…" }
    }
  }
}

Clients that support remote servers with OAuth can use the endpoint URL directly and sign in through the tenant's identity provider (the protected-resource metadata tells them where). Client configuration formats change; check your client's documentation for the current syntax.

Any agent framework

Use your framework's Streamable HTTP MCP client with the endpoint URL and the X-Api-Key header. A good system prompt: "Answer only with metrics from the Keel tools; say which metrics you used and warn when a metric is not certified or has low trust."

What the agent can't do

See masked values: masks are compiled into the SQL, so tool results carry ****, hashes or NULL exactly as a person with the same role would see. API keys are evaluated as Analysts.
Discover hidden assets: a denied metric or dimension is indistinguishable from one that doesn't exist.
Run arbitrary SQL, read more than 1,000 rows per call, or bypass the endpoint's rate limit.

Scaling out

The server keeps sessions for clients that initialize (so it knows their name). With several Keel.Mcp instances, route each session to the same instance (session affinity).

MCP for AI agents ​

Tools and resources ​

Set up ​

Claude Code ​

Claude Desktop and other stdio-only clients ​

Any agent framework ​