MCP Server

What Is MCP?

The Model Context Protocol (MCP) is an open standard that lets AI assistants connect to external services and use their tools. Yaplet exposes an MCP server so you can work in your account from any MCP-compatible client — teach your AI agent, write knowledge base articles, draft email campaigns, handle conversations and tickets, and more, all through natural language.

The same server powers Copilot, the assistant inside your dashboard, so an outside AI app and Copilot can do exactly the same things.

How Authentication Works

Yaplet's MCP server supports two authentication methods. Both let you decide how much the AI may do.

OAuth 2.0 (Browser Login)

The default method. Just add the server URL to your client — when you connect, your browser opens a login page where you sign in with your Yaplet account, pick your organization, and approve access. On that page you also choose:

• Which areas the app may work in — one checkbox per area (widgets, conversations, tickets, newsletter, workflows, and so on). Only areas your permissions allow are offered.
• What the app may do — one of three access levels:

Everything the app does is done as you, with your permissions. If you suspend a team member, every app they connected stops working at once, and works again when you re-enable them.

The page also names the app that asks to connect and the address you are sent back to once you approve. Yaplet has not checked the app, so continue only if you started the connection yourself. A link with an unknown app, or with a return address the app never registered, shows This sign-in link is not valid instead, with nothing to approve.

API Key

For clients that don't support OAuth redirects (like Cursor or Antigravity), you can authenticate with an API key instead. Generate one at Settings → Organization settings → API in your dashboard, switch its AI access (MCP) on there, then pass the key as a Bearer token in the Authorization header of your MCP config.

Setup Guides

Yaplet's MCP server is available at:

https://yaplet.com/api/mcp

It uses the Streamable HTTP transport — the current MCP standard. Select your client below for setup instructions.

{
    "mcpServers": {
        "yaplet": {
            "command": "npx",
            "args": ["-y", "mcp-remote", "https://yaplet.com/api/mcp"]
        }
    }
}

{
    "mcpServers": {
        "yaplet": {
            "command": "npx",
            "args": ["-y", "mcp-remote", "https://yaplet.com/api/mcp", "--header", "Authorization:Bearer yAPI_your-api-key-here"]
        }
    }
}

claude mcp add --transport http yaplet https://yaplet.com/api/mcp

{
    "mcpServers": {
        "yaplet": {
            "type": "http",
            "url": "https://yaplet.com/api/mcp"
        }
    }
}

{
    "mcpServers": {
        "yaplet": {
            "type": "http",
            "url": "https://yaplet.com/api/mcp",
            "headers": {
                "Authorization": "Bearer yAPI_your-api-key-here"
            }
        }
    }
}

{
    "servers": {
        "yaplet": {
            "type": "http",
            "url": "https://yaplet.com/api/mcp"
        }
    }
}

{
    "servers": {
        "yaplet": {
            "type": "http",
            "url": "https://yaplet.com/api/mcp",
            "headers": {
                "Authorization": "Bearer yAPI_your-api-key-here"
            }
        }
    }
}

{
    "mcpServers": {
        "yaplet": {
            "url": "https://yaplet.com/api/mcp"
        }
    }
}

{
    "mcpServers": {
        "yaplet": {
            "url": "https://yaplet.com/api/mcp",
            "headers": {
                "Authorization": "Bearer yAPI_your-api-key-here"
            }
        }
    }
}

{
    "mcpServers": {
        "yaplet": {
            "serverUrl": "https://yaplet.com/api/mcp"
        }
    }
}

{
    "mcpServers": {
        "yaplet": {
            "serverUrl": "https://yaplet.com/api/mcp",
            "headers": {
                "Authorization": "Bearer yAPI_your-api-key-here"
            }
        }
    }
}

How the AI Works in Yaplet

Your AI app sees nine tools. It doesn't need one tool per feature: it looks up the action it needs, then runs it.

Behind find_actions sit around a hundred small actions, each one thing you would ask for in one sentence — Update ticket, Clock in, Write article with AI. Each has a name like tickets.update, and each is one of three kinds that match the three access levels:

An app connected below the level an action needs doesn't get the run tool for it, and find_actions tells it which level is missing. Some actions write text with AI; those are marked as using AI credits.

Actions by area

Each page lists every action in its area, what it does, and what an AI cannot do there.

How a Task Runs

You don't need to orchestrate anything — describe what you want and the AI works through it.

Example: Asking "Add a document about our refund policy to my AI agent's knowledge and write a help article covering the same thing" would find your AI agent, add and index the document, then write the article and publish it — all from a single prompt.

What an AI Can Never Do

Some things stay with a person in every connection — Copilot, browser logins and API keys alike. The AI can explain them and link you to the right dashboard page, but it cannot do them, even when asked:

• Money: your plan, add-ons, the payment card, credit top-ups, phone numbers, the dedicated IP.
• Access: team members, invitations, permissions, members' pay rates, API keys, integrations.
• The account: data export, deleting the account, signing the data-processing agreement.
• Emails to your subscribers and public posts: an AI never sends, schedules or resumes a campaign, switches an email automation on, approves a Newsletter Autopilot issue, switches an autopilot's Require my approval off or switches on one that sends without approval, and never publishes a social post. It prepares the draft and tells you where to send it or switch it on.
• Switching a chat workflow on: an AI creates and changes only workflows that are switched off. It may switch a workflow off, but never on, and a change to a workflow that is on is refused — the AI has to switch it off first, or duplicate it and change the copy. You switch a workflow on in the dashboard.

Deletes are limited too: one named record at a time, and the AI must repeat the record's exact name, so a wrong id is refused. A workflow can only be deleted while it is switched off. An AI never deletes in bulk by a filter, never deletes a brand, widget, knowledge base, documentation set or board, and never deletes subscribers.

Privacy & Security

• All requests are authenticated and scoped to one organization.
• Every connection runs as one person and can do only what that person's permissions allow in the dashboard right now. Suspending a member stops their Copilot, the apps they connected and the API keys they switched on, at once.
• Every change, delete and send an AI makes is written to your Audit Log as AI change or AI delete or send, naming the person, the connection (Copilot, the app's name or the API key's name), the action and the record. The values sent are not stored there. Reads are not logged.
• Apps connected by browser login cannot see or add private notes in conversations; Copilot and API-key connections can.
• Results that contain text written by outsiders — such as visitor messages, survey answers or fetched web pages — reach the AI with a note that they are data, never instructions.