Administration

API access & MCP

Scoped tokens for the things outside the appliance that need to talk to it — and an MCP endpoint that lets a coding agent on your laptop read and work the board.

API tokens

Tokens are minted under Settings → API Access, start with talon_ctl_, and are scoped. They exist for callers that are not a browser session: a backup script on the host reporting that last night's dump succeeded, a home-screen widget asking for today's summary, an agent on your laptop reading the board.

Shown once

A token is displayed at mint time and never again — the stored form cannot be read back. Lost token, new token; there is no reveal.

The MCP endpoint

Control speaks MCP over streamable HTTP in its stateless form — plain JSON-RPC over POST, no session, no SSE — which is exactly what an MCP-capable coding agent expects when you add an HTTP transport with a header.

terminal

claude mcp add --transport http control \

  https://control.example.com/api/mcp \

  --header "x-api-key: talon_ctl_…"

The endpoint is rate-limited per token and every call is attributable to the token that made it.

What the tools do

Reads

readBoard, readCard, readPrd, readBrain, readProductMap, readRepoArchitecture, readFocus, readObjectives, readRoadmap — the board, the spec, the company's memory and the shape of the code.

Direct writes

tickChecklist and setFeatureStatus. Both are statements about work that already happened, and both are one click to undo.

Gated write

proposeCard — the only tool that creates work, and it creates it at gate 1, waiting for a person.

That split is the same one the in-process dev-session server uses. An external agent has no more authority than an internal one.

The permission shape

Worth stating plainly, because it is what makes handing a token to an agent reasonable: reads are free, recording what happened is direct, and creating work is a proposal. There is no MCP tool that sends mail, spends money, or moves a card to done.

streamable HTTPtalon_ctl_ tokensrate limited per tokengate 1 on every created card