Developers
Built fast, by hand or by agent
The same rules, whichever way the work arrives: the browser, the command line and the MCP authoring surface all write through one path. An agent with the authoring skill builds an integration alone, and what it cannot verify, it says.
The loop, one command each
Look at the environment, probe a call, write the files, lint, apply, run with a trace, read what came back, fix, step through where the middle writes. Every command answers JSON and an exit code a machine can act on; an unknown flag is refused rather than ignored, so a typo can never turn a dry run into a real apply.
The commands: login · whoami · setup · filestore · files · entity · apply · describe · lock · run · probe · sessions · position · continue · abort · history · inspect · authoring-pack.
The loop in the docs →a9script probe JiraGetIssue --input '{ "key": "KAN-9" }' --json
# → the request as sent, the far end's own answer,
# and the shape a script will getA folder is the integration
One JSON file per entity, names never ids; the connection a call uses is named, and the script's code sits in a file beside it. apply --dry-run lints the whole folder and reports every warning without writing; apply writes it as one change and never deletes. The folder is what an agent writes and what a person reviews.
{
"type": "http",
"connectionName": "Jira",
"method": "GET",
"path": "/issue/{{key}}",
"params": [
{
"name": "key",
"description": "The issue key, like KAN-9."
}
],
"expect": [
200
],
"answer": {
"path": "fields"
}
}Why handing an agent a token is safe
- A token names one tenant and one environment when it is minted; outside them everything answers not found.
- It always expires, and it can never mint a successor with more rights than itself.
- It cannot change a connection or any other credential-bearing entity unless minted with that permission — referencing one by name is the workflow.
- It never sees a secret value: not in a read, a diff, a recorded request or a trace.
- A call that writes to a far end needs the environment's switch AND an acknowledgement, and is audited.
- Debug, step and probe exist only in a sandbox; production refuses them before anything runs.
Nothing installed: the authoring surface is MCP
An assistant that speaks MCP needs a URL and a bound token. Every command that crosses is a tool with a declared schema; an undeclared argument is refused. Three stay on the terminal by decision: signing in, the first-time setup, and moving files.
Building over MCP in the docs →Any HTTP API you configured becomes an MCP server
Set an endpoint to MCP and list operations that name your configured calls or scripts. An assistant lists and calls them as tools; each tool's input schema is generated from the parameter structure you declared, never typed. A tool call runs on the ordinary path and answers under the synchronous budget; a run that would have to wait is stopped and the client is told.
Answering a caller in the docs →
