Embed MCP

Give an AI agent — your own, or your customers' — control of Coassemble. The agent operates the whole course lifecycle through one tool surface, exposed both as an MCP server (for MCP-speaking clients) and as plain REST endpoints (for everything else).

What the agent can do

The agent exposes the course lifecycle as tools:

Create — courses, screens, and blocks.
Enrich — themes, brand voice, translations, and narration.
Publish & share — publishing and share links.
Organise — collections and folders.
Measure — course analytics.

Which tools a token can run is filtered by the workspace plan, an optional per-token allowlist, and a read-only flag (see Tenancy & scoping).

MCP vs. agent-tooling endpoints

Two ways to reach the same tools — pick whichever fits your integration:

MCP (POST /agent/mcp, JSON-RPC 2.0) — for clients and agent frameworks that speak the Model Context Protocol. The client connects once, discovers the tools, and calls them. This is the right choice when an LLM is driving the integration.
Agent tooling (GET /agent/tools, POST /agent/tools/{name}, plain REST) — for HTTP integrations that do not speak MCP. List the available tools, then call one by name. See the Agent API reference.

info

There is also a consumer MCP at POST /mcp for connecting your own AI client (Claude, Cursor, and others) to your workspace. It uses an OAuth sign-in flow instead of an agent token, and you can connect it straight from the MCP tab in your workspace settings — no code required.

Authentication Scale and above

Embed MCP and the agent tooling endpoints are authenticated with an agent token — a bearer token you mint with your workspace API key. It requires the api_advanced entitlement.

Mint an agent token

curl -X POST https://api.coassemble.com/agent/auth \
  -H "Authorization: COASSEMBLE:<workspaceId>:<apiKey>" \
  -H "Content-Type: application/json" \
  -d '{
    "identifier": "user@example.com",
    "clientIdentifier": "tenant-123",
    "readonly": false
  }'

The response contains the token and its expiresAt. Tokens are long-lived (30 days by default). Full request/response schema is in the Agent API reference.

Tenancy & scoping

The token you mint carries the scope the agent runs within:

identifier — the stable end-user the agent acts as (required).
clientIdentifier — a tenant key for multi-tenant embeds. Courses are isolated per tenant; one tenant can never read another's content. Omit for workspace-default scope.
tools — a per-token allowlist. Omit to expose the full surface.
courseId — pin the token to a single course.
readonly — when true, only read tools run.

Connecting over MCP

Point your MCP client at POST /agent/mcp with Authorization: Bearer <agent-token>. The transport is JSON-RPC 2.0 over HTTP. A typical session initializes, lists tools, then calls them:

initialize

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "initialize",
  "params": {
    "protocolVersion": "2025-06-18",
    "capabilities": {},
    "clientInfo": { "name": "your-app", "version": "1.0.0" }
  }
}

tools/list

{
  "jsonrpc": "2.0",
  "id": 2,
  "method": "tools/list"
}

tools/call

{
  "jsonrpc": "2.0",
  "id": 3,
  "method": "tools/call",
  "params": {
    "name": "create_course",
    "arguments": { "title": "Onboarding 101" }
  }
}