Connect an agent in one command
For Claude Code, with an API key from your workspace:
claude mcp add --transport http codekasten https://mcp.codekasten.com/mcp \
--header "Authorization: Bearer sk_…"The server tells the agent which record types exist and what their fields are called, so it works with your workspace as it is, not with a fixed schema.
Not a database connection
A database MCP server gives an agent tables, and the usual safeguard is a database account with limited rights. That protects the data, but what an account may write, it writes live.
CodeKasten's server works with records, by the field names your types define, and it answers the harder question of how an agent can write safely:
- An agent never writes to a protected branch. It commits on its own branch and uses
request_mergeto ask the people who may merge. - It acts for a person. It does no more than they may, and a reader's agent only reads.
- Each tool declares what it does: it reads, changes, removes, or reaches outside CodeKasten. A client that lets read-only tools run without asking never lets through one that changes something.
- A refusal is worded for the model, so the agent can explain it or try another way.
More in AI agent guardrails.
What an agent can do
| Tools | For |
|---|---|
workspace_info, describe_entity_type | Learning the workspace and its types |
search_records, get_record, query_records | Finding, reading and adding up records |
create_record, update_record, link_records | Changing records on its branch |
get_document_text, set_document_text | Reading and writing documents, as Markdown |
create_entity_type, add_field, save_workflow | Building types and workflows |
commit, request_merge | Handing the work to a person |
ask, send_to_inbox, watch | Asking a person, telling people, waiting for changes |
The MCP docs list them all. A type with Give agents tools for this type switched on also gets its own create_<type> and search_<type> tools.
When the agent needs a decision
The ask tool puts a question in its person's Inbox, on the web or on their phone. The agent waits up to 50 seconds for the answer. Unanswered, it gets a ticket to read the answer with later. Either way the answer stays with the question: who decided what, and when.
Also through GraphQL
People's own programs get the same data through a GraphQL endpoint, with the same keys. See how we build with agents through MCP.