MCP server

Manage your Cysora agent from the AI tool you already use. Connect Claude, Cursor, or any MCP client and pull back leads, read conversations, and update your sales process — with scoped, revocable keys you control.

Get started in two steps

Create a secret API key on the dashboard's API Keys & MCP page and choose which domains it can read or write.
Add the endpoint below to your MCP client with that key as a bearer token.

The full list of MCP tools your key unlocks — grouped by domain — is shown on that same API Keys & MCP page, so you can see exactly what each key can do before you connect it.

What it is

The Cysora MCP server exposes a curated subset of the public /api/v1 surface to MCP-capable clients (Claude Desktop, Cursor, Cline, and any other JSON-RPC over HTTP MCP client). It does not mirror the entire API — tools are selected for safe reads and bounded writes, and each caller only sees the tools their API key has been granted.

Endpoint

Method	Path	Auth	Transport
`POST`	`/api/mcp`	`Authorization: Bearer cys_...` — secret API key only	JSON-RPC 2.0 Streamable HTTP JSON

GET /api/mcp returns 405. Query-string credentials are rejected, as are publishable cys_pk_... widget keys. Batch JSON-RPC arrays are intentionally not supported.

Supported JSON-RPC methods

Method	Behavior
`initialize`	Returns protocol version, server info, and tool capability.
`ping`	Empty result.
`tools/list`	Returns only the tools allowed by the API key's grants.
`tools/call`	Dispatches one curated tool to the backing `/api/v1` route with the caller's bearer key.
`notifications/initialized`	Acknowledged with an empty 202.

What you can do

Curated MCP tools cover lean reads plus bounded management of existing leads, conversation handling, agent settings, sales-process modules, catalog integrations, and team access. Conversation tools can read the full user/assistant transcript, switch AI ↔ manual handling mode, and send a WhatsApp reply only while the thread is manual and Meta's 24-hour inbound window is open. Team tools invite or update members and grant agent access.

MCP intentionally does not create net-new leads, run destructive operations, trigger outbound connector tests or provider syncs, read secrets, regenerate or publish agent prompts, or issue invoice URLs.

Grant model

Secret API keys carry per-domain grants (read or read_write). MCP filters the tool catalog by those grants — a key with leads: read only sees read-only lead tools; a key with no entry for a domain sees no tools for it. Manage keys and their grants on the dashboard's API Keys & MCP page.

Client config

Point any MCP client at the endpoint using its usual config format:

{
  "mcpServers": {
    "cysora": {
      "url": "https://www.cysora.com/api/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_SECRET_KEY"
      }
    }
  }
}

Keep secret keys server-side or inside trusted local MCP client configuration. Do not put them in browser code, URLs, or logs.