MCP integration

The hosted MCP server is https://mcp.weirgate.com/mcp. It is an independent HTTPS client of the public management API, not a privileged path into Weirgate.

Start from a dashboard-issued grant. Choose the tenant, test environment, app allowlist, tool groups, expiry, and scope in the consent screen. Propose is the safe default. Store only the environment-variable reference in MCP configuration:

[mcp_servers.weirgate]
url = "https://mcp.weirgate.com/mcp"
bearer_token_env_var = "WEIRGATE_API_KEY"

Begin with weirgate_whoami, search the canonical docs, then inspect apps and readiness. Use proposals for app, feature, tier, rule, and webhook changes. Present the server's diff and pause for human approval before any apply. Grants and reversals are immediate money actions and require an apply-scoped grant plus a stable idempotency key.

MCP has no generic HTTP, SQL, provider-key value, management-key mint, destructive deletion, or live-inference tool. Provider credentials enter only through the local CLI browser or hidden-stdin ceremony.

Every result carries the upstream request_id and api_version. Branch on typed error values, never message strings.