Access layer / agents

ApexMCP

Product-native tools and resources for AI agents.

ApexMCP lets AI agents work inside ApexAi products through the Model Context Protocol. An agent discovers what a product can do, inspects owned work, retrieves data, and takes named actions—with the product's own identity, policy, and evidence underneath.

Why product-native

Give agents the product, not a terminal.

An agent should not need shell access, database credentials, or a generic web tool to operate a product. ApexMCP exposes the product's own concepts—jobs, datasets, communications, incidents—as tools and resources that carry the product's permissions.

Tools act, resources describe

Tools are named operations with typed inputs. Resources expose state an agent can read and subscribe to without taking any action.

Structured outputs

IDs, lifecycle state, validation failures, and evidence come back as structured data, so an agent never infers them from prose.

Inherited identity

The MCP server reuses an identity the product already trusts—an authorized operator, or an account-bound API credential—instead of inventing a new authority.

Evidence without exposure

An agent can see what happened and why, without access to secrets, other tenants, or a raw execution environment.

Untrusted content stays marked

Page text returned to an agent is fenced and flagged as untrusted external content, so instructions hidden in a page are read as data, never followed.

A read-only profile

A server can run with every tool that changes something switched off, for agents that should only look.

What an agent can do

Discover, acquire, inspect, retrieve, understand, act.

Three verbs only read. Acquire and Act change something, and Understand runs on the caller's own AI provider, so each is limited to named operations that pass product policy and leave evidence.

Read

Discover

What the server can do, which spiders exist, whether the project and your AI provider are ready, and your credit balance.

Side effect

Acquire

Scrape a URL, map a site, scrape a batch, or start a bounded crawl: each an ordinary gated job.

Read

Inspect

Owned jobs, their state and results, and the artifacts they produced, including a page as Markdown.

Read

Retrieve

Datasets, versions, fields, typed queries, version diffs, and search and fetch over active versions.

Side effect

Understand

Extract to a schema, extract a whole dataset into a new version, and answer questions with citations, on your own AI provider.

Side effect

Act

Named operations with side effects, each passing the same product policy as any other caller.

Scrawl MCP

Scrape, crawl, query, and cite, for agents.

Scrawl is where ApexMCP is furthest along. Agents scrape and map pages, crawl into versioned datasets, query and compare versions, extract with the caller's own AI, and ask questions answered with citations, including a search-and-fetch contract built for AI retrieval.

Built

Discover

apex_scrapy_status
apex_scrapy_version
apex_scrapy_list_capabilities
apex_scrapy_list_spiders
apex_scrapy_check_project
apex_scrapy_ai_status
apex_scrapy_credit_balance

Acquire

apex_scrapy_scrape_url
apex_scrapy_map_url
apex_scrapy_batch_scrape
apex_scrapy_start_crawl

Inspect

apex_scrapy_list_jobs
apex_scrapy_get_job
apex_scrapy_scrape_result
apex_scrapy_batch_status
apex_scrapy_list_artifacts
apex_scrapy_read_artifact

Retrieve

apex_scrapy_list_datasets
apex_scrapy_get_dataset
apex_scrapy_list_dataset_fields
apex_scrapy_query_dataset
apex_scrapy_query_dataset_version
apex_scrapy_diff_dataset_versions
search
fetch

Understand

apex_scrapy_extract
apex_scrapy_extract_dataset
apex_scrapy_ask

Act

apex_scrapy_cancel_job
apex_scrapy_activate_dataset_version
apex_scrapy_set_record_quarantine

Resourcesapex-scrapy://datasetsapex-scrapy://datasets/{dataset_id}apex-scrapy://records/{document_id}

Identity

Borrowed, not invented

A self-hosted server acts as an authorized operator; a hosted server acts as an account-bound API identity. Crawls still pass billing, abuse, proxy, catalog, and egress checks.

Retrieval

Search and fetch

Agents search the active dataset versions and fetch full records by ID, citing the exact version-specific document they read.

Updates

Subscribe to change

Dataset resources publish update events when a new version is published, so an agent can refresh instead of polling.

Communications MCP

Governed communications for agents.

Planned

Communications will expose its own concepts to agents, with consent and Trust and Safety applied exactly as they are for operators and software:

Until then, the Communications contract for software is its ApexAPI.

DevOps MCP

Investigate incidents. Leave authority with policy.

DevOps will let agents work an incident the way an operator does—read what was detected and decided, retrieve the evidence, and see what needs attention—without a terminal, credentials for your systems, or any power to choose an action:

Planned

In the engine today

Read-only inspection

The DevOps engine already includes a read-only MCP inspection interface that ApexAi's own operators use. It covers status, incidents, decisions, changes, evidence, attention, owed work, watches, ownership, budgets, and remedy memory.

Embedded hosts only

One bounded cycle

A host that embeds the engine can also offer one request: run a single bounded control cycle on one system. The controller still decides everything, and the request cannot choose an action, grant authority, or override ownership.

Not a customer service

Internal tooling

That interface is internal tooling. There is no customer DevOps MCP server, endpoint, or credential.

The DevOps engine's status is on the DevOps page.

Transport and topology

A family of servers, not one gateway.

Each product ships its own MCP server with its own identity—Scrawl's is built; Communications' and DevOps' are planned. There is no universal remote server, shared authentication contract, or public gateway across products. The transports below are Scrawl's.

Scrawl MCP transports
Transport	How it runs	Status
stdio	The agent host launches the server locally; nothing listens on the network.	Built
Streamable HTTP · loopback	A long-running server on the same machine or behind a private tunnel, refusing non-loopback binds.	Built
Authenticated remote	Remote access with per-request identity, once each product implements it.	Planned