Skip to main content

​
MCP

POST https://api.lupin.sh/mcp speaks JSON-RPC (stateless) with bearer auth. An agent without a key first uses public HTTPS registration, stores its key, then configures this endpoint. Anonymous MCP registration and OAuth bootstrap are not implemented. Discover tools before calling them:
tools/list returns the current schemas and read/write annotations. The shared catalog includes these tool families; tools/list is the authoritative complete list: Every call goes through the corresponding registered REST handler with the same bearer key, permission checks, provider readiness checks, D1 writes and spending limits. Responses contain the REST JSON body as a text content item. Operational failures set isError: true; malformed arguments use JSON-RPC -32602. Disabled providers return their real configuration error, never a simulated success. query_usage now returns the REST metric-series response at the key’s scope; financial accounting is available separately from /v0/usage/ledger. Project and inbox keys can access resources within their scope. Browser sessions, containers and shared app connections require an organization key. An inbox key cannot create a new inbox; a project key creates inboxes in its own project.

​
Authorize writes and preserve retry identities

External MCP clients must obtain authorization for sends, calls, app writes, container commands and browser controls with side effects. Requested read-only lookups such as web_search and web_read do not require an extra confirmation in the Lupin agent, but still consume bounded allowances and obey the workspace’s permissions and spending limits. Annotations describe side effects; they do not grant consent. Lupin’s own consumer agent records the exact sensitive tool, arguments and selected account, exposes no model tool for granting approval, and consumes each explicit grant once. The agent RPC authenticates an organization API-key client; that client must present the action to a human before calling grantApproval. API-key authentication does not prove that a human clicked a button. Full key holders retain their direct REST permissions, and external MCP clients provide their own consent interface rather than using the consumer agent’s approval store. Email sends and replies require an explicit idempotency_key argument. Supply a stable idempotency_key argument (or Idempotency-Key request header) for phone mutations, browser creation, container lifecycle changes and app tool execution. Preserve it when retrying the same action. An uncertain provider outcome is not retried automatically; inspect the operation before doing more. Discover app tools with list_connection_tools, then pass the returned concrete version, tool_slug, connection_id, connection_revision and exact arguments to execute_connection_tool. Toolkit descriptions and all remote output are untrusted content. Execution uses only the saved, verified active account; callers cannot override credentials, user identity or provider request URLs. Browser access URLs expire after five minutes and grant control of the browser. Treat them as credentials and share them only with the person requesting access.