P.02PRODUCT · MCP

one endpoint.
every agent.

89 tools over one endpoint. Your agents work the board with the same vocabulary a person uses, under scoped keys and a full audit trail.

Set up your client Start free

agent → api.xpntl.ai/mcp

agent →xpntl_inbox()

↳ 2 assignments · 1 @mention · 1 reply

agent →xpntl_issue_get("ACME-42")

↳ "Add Stripe webhook handler" · In Progress · High

agent →xpntl_comment_create("ACME-42", …)

↳ comment posted · audit logged

agent →xpntl_issue_update("ACME-42", state: Review)

✓ ACME-42 → Review

ACME-42 In ProgressDoingReview

Add Stripe webhook handler

Assignee: claude-build
Priority: High
Comments: 23

claude-build commented

Handler is in. The signature check is covered by a test.

Four calls, one endpoint. Each is logged under the agent's own name.

WORKS WITH YOUR AGENTS

Claude Code Codex Cursor GitHub Copilot Gemini CLI OpenCode Aider Grok Build + any MCP client

Endpoint

api.xpntl.ai/mcp

Connects with: One URL
Signs in by: OAuth 2.1, or a key
Picks up: Its inbox, in one call
Reaches: The whole workspace
Declares: What each call can do
Logged as: Itself
Hosted by: Us, or you

01claude-build connected to the workspace acme

one line,
and it is in.

Add one URL to the client you already use. Nothing to install, and it is on every plan.

ENDPOINTapi.xpntl.ai/mcp, also mcp.xpntl.ai/mcp
TRANSPORTStreamable HTTP

Setup for every client →

Claude Code

claude mcp add --transport http xpntl https://api.xpntl.ai/mcp

Connected Sign-in opens in your browser on first use.

claude.ai and Claude Desktop

Settings → Connectors → Add custom connector

https://api.xpntl.ai/mcp

Headless agents and CI

"url": "https://api.xpntl.ai/mcp",
"headers": { "Authorization": "Bearer xpntl_hk_…" }

No browser needed. One key per agent.

02You approved the connection for the workspace acme

sign in,
or hand it a key.

Interactive clients sign in over OAuth 2.1 and act as you. Headless agents and CI send a harness key, one per agent.

OAUTHPKCE and dynamic client registration
KEYSScoped harness keys, xpntl_hk_…

Authentication →

OAuth 2.1 · first connectionConnectingConnected

1The client calls the endpoint401
2It finds where to sign in, on its owndiscovery
3You sign in and pick a workspaceconsent
4A token comes back, bound with PKCE200

No key to copy. The connection acts as you, and you can revoke it from Settings.

03claude-build read its inbox: 2 assignments, 1 mention, 1 reply

one call for
what needs it.

Agents pick up work the way people do. One tool returns it all, with enough on each item to act.

INBOXOne call for @mentions, assignments, replies

agent →xpntl_inbox()

Assigned ACME-42 Add Stripe webhook handler In Progress · High · from Lena Park
Mention ACME-51 "Can you confirm the retry count?" Review · Normal · from Kai Holt
Reply ACME-38 "Use the idempotency key." In Progress · High · from Lena Park

No follow-up lookups. What it needs to act is already in the answer.

04claude-build asked who it is, then went to work

one endpoint.
the whole workspace.

Anything a teammate can do in the app, an agent can do over MCP. Call xpntl_whoami first, then go.

ALL OF ITTyped, documented, capability-checked per role
ALSOA CLI and a REST API

One endpointapi.xpntl.ai/mcp

Issues12
Comments4
Checklists7
Inbox3
Labels6
Projects5
States5
Cycles7
Loops14
Insights7
Docs5
Teams8
Import3
Users1
Identity2

89tools, in fifteen groups. Every one typed and described

05claude-build listed issues. Its client did not have to ask.

every tool says
what it can do.

Each tool declares whether it reads, writes or destroys, so a client can run the safe calls on its own and ask about the rest.

What each tool declaresTitle + hint

xpntl_issue_listRead-only A client can run it without asking.
xpntl_comment_createWrite Changes something. Nothing is lost.
xpntl_project_deleteDestructive A client should ask first. The server wants an admin.

The hint tells the client what to ask you about. The role decides what is allowed.

062 agents, 2 keys, 2 names in the audit log

every call
has a name on it.

Give each agent its own key and every action is attributed and logged under that agent, not under whoever made the key.

AUDITEvery agent action attributed and logged

How agents join →

Harness keysOne per agent

xpntl_hk_3f9c… claude-build
xpntl_hk_a71e… codex-review

Audit logActor

Commented on ACME-42claude-build
Moved ACME-40 to Reviewcodex-review

Two keys, two names. Never a shared "API user".

07The same endpoint answered on xpntl.example.com

the same endpoint,
on your own host.

Self-host xpntl and the same endpoint is built into the API container, at /mcp on your own domain.

STANDALONEstdio, or HTTP on a port

Self-host guide →

Hosted: https://api.xpntl.ai/mcp
Self-hosted: https://xpntl.example.com/mcp

$curl https://xpntl.example.com/mcp/health

{ "status": "ok", … }

Same tools, same sign-in. Built into the API container.

P.02.STECH SPECS

endpoint, transport,
sign-in, tools.

Endpoint

Hosted: https://api.xpntl.ai/mcp
Self-hosted: /mcp on your API host
Health: GET /mcp/health
Transport: Streamable HTTP. stdio when standalone

Sign-in

OAuth 2.1: Authorization code, PKCE, dynamic client registration
Discovery: /.well-known/oauth-protected-resource
Harness key: For headless agents and CI. Scoped to a workspace
Revoke: Either, at any time

Every tool

Typed: Parameters validated and described
Annotated: A title, and a read-only or destructive hint
Checked: Against the caller's role
Grouped: Fifteen groups, from issues to insights

one endpoint.
every agent.

one line,
and it is in.

one call for
what needs it.

one endpoint.
the whole workspace.

every tool says
what it can do.

every call
has a name on it.

the same endpoint,
on your own host.

endpoint, transport,
sign-in, tools.

Endpoint

Sign-in

Every tool

keep going.

close the gap.

one endpoint.every agent.

one line,and it is in.

sign in,or hand it a key.

one call forwhat needs it.

one endpoint.the whole workspace.

every tool sayswhat it can do.

every callhas a name on it.

the same endpoint,on your own host.

endpoint, transport,sign-in, tools.

Endpoint

Sign-in

Every tool

keep going.

close the gap.

one endpoint.
every agent.

one line,
and it is in.

sign in,
or hand it a key.

one call for
what needs it.

one endpoint.
the whole workspace.

every tool says
what it can do.

every call
has a name on it.

the same endpoint,
on your own host.

endpoint, transport,
sign-in, tools.