MCP Integration

Stage: platform (MCP server) · What it does: expose your catalog, data, pipelines, and models to AI agents through the Model Context Protocol (MCP) — the open standard Claude/Copilot-class agents use to reach tools and data. Both consoles are MCP servers: platform.k3ld.com (data catalog, SQL, Ask AI, pipelines) and model.k3ld.com (training runs, fine-tune/post-train/pretrain launches, deploys, GPU smoke, exports, drift monitor).

Why it matters

Your data, agent-ready. Instead of writing bespoke glue for every agent, one MCP server publishes your governed data sources as agent-callable tools.
Governed. An agent runs as the connected user — your role, RLS row filters, masking, platform-access grants, instance RBAC, tiers and tenant scope all apply to every tool call. No "agent with a bucket key" sprawl.
Paid actions are two-step. Launching a fine-tune, a pretrain, an endpoint, an export, or running a pipeline requires an estimate → confirm token (single-use, 30-min, pinned to the instance) — no bare-boolean launches from an agent.
Open standard. JSON-RPC 2.0 over HTTP POST, protocol version 2024-11-05. Any MCP client works.

Connect

Both servers live on the API base and share your existing user credentials (a user-scoped k3ld_… API key, or a browser session cookie).

Console	Endpoint	Server	Tools
Data (platform.k3ld.com)	`POST https://api.k3ld.com/api/v1/mcp/platform`	`k3ld-platform` 0.2.0	11
Model (model.k3ld.com)	`POST https://api.k3ld.com/api/v1/mcp/model`	`k3ld-model` 0.6.0	20

.mcp.json (Claude Code / Cursor):

{
  "mcpServers": {
    "k3ld-platform": { "type": "http", "url": "https://api.k3ld.com/api/v1/mcp/platform",
      "headers": { "Authorization": "Bearer k3ld_YOUR_API_KEY" } },
    "k3ld-model":    { "type": "http", "url": "https://api.k3ld.com/api/v1/mcp/model",
      "headers": { "Authorization": "Bearer k3ld_YOUR_API_KEY" } }
  }
}

Mint a user API key in Settings → API keys (admin/editor), or use the System → MCP access page in either console for a ready-to-paste config and the live tool list.

Tools

Data console (`platform_*`)

Reads: console_whoami, platform_list_tables, platform_get_schema, platform_ask (NL → SQL → governed rows), platform_run_sql (read-only), platform_list_pipelines, platform_get_pipeline (full DAG), platform_list_files, platform_list_connections.
Writes: platform_save_pipeline (create/update a pipeline DAG — same validation + versioning as the console), platform_run_pipeline (run a data pipeline: quota, destructive-step approval, catalog source pre-check, metered DuckDB execution).

Model console (`model_*`)

Reads: contracts, runs, adapters, endpoints, monitor schedules, drift scans.
Estimate → confirm (two-step): model_recommend_finetune → model_launch_finetune, model_recommend_train → model_launch_train (from-scratch pretrain), model_deploy_estimate → model_deploy_endpoint (create/resume), model_smoke_estimate → model_smoke_test (GPU pre-launch gate).
Other actions: model_stop_endpoint (reversible), model_export (standalone conversion/merge).
The full deploy lifecycle is agent-drivable: launch a fine-tune → poll model_get_run → model_deploy_estimate/model_deploy_endpoint (auto-export + verify when needed) → poll model_list_endpoints until InService → invoke via the platform API.

Governance & safety

Every tool executes under withGov(...) as the connected user: RLS/masking at the source, table ACLs, role checks, instance grants, tier/quota — identical to the console UI.
Read tools never return tenant-private S3 artifact/bucket identifiers.
Per-profile rate ceilings in the envelope: 180 calls/min for reads, 6/min for paid (action) tools — the paid set is exactly the launch/export/deploy/run/smoke tools.
Every call is audited (mcp.console_tool) with the user + tool + latency.
Pipelines with high-risk destructive steps wait for human approval before an agent can run them.
Ask-AI mutation proposals are returned for console confirmation — never auto-executed from MCP.

Real-world examples

🧑‍💼 SaaS — support agent with the actual product data

A support team wires their agent (via MCP) to the product's support catalog and documentation. The agent answers with their content, not a generic model's guess — and the access is scoped, so it can't reach customer PII.

🏦 Financial services — analyst copilot over governed sources

Analysts use a copilot that reaches the internal data catalog through MCP. The copilot can only touch datasets the analyst's role permits — the agent inherits RBAC, so "ask the copilot" never becomes "the copilot has a master key."

🚀 ML platform — an agent that tunes, ships, and monitors a model

An MCP client recommends + launches a fine-tune (model_recommend_finetune → model_launch_finetune), polls it to completion, deploys it behind an estimate→confirm token, runs a GPU smoke first, and checks drift schedules — the whole Build→Ship→Monitor loop through one governed surface.

Gotchas

MCP access is user-scoped — the agent sees exactly what the signed-in user's role/RLS/grants permit.
Paid tools require the estimate→confirm token; tokens are single-use and expire in 30 minutes.
platform_run_pipeline runs data (DuckDB) pipelines; ML/NN/LLM-format pipelines must run from the console.
Agent tool calls are auditable like other platform actions.

Status

Both servers live and exercised end-to-end (2026-09-05): fine-tune launch → deploy → verify → InService → real invocation; GPU smoke; from-scratch pretrain launch; pipeline save + run (12 rows) — all driven over MCP.