Developers

MCP server

Connect AI agents over the Model Context Protocol, with OAuth 2.1 scopes narrowed to the user’s role.

Remote MCP endpoint (Streamable HTTP, stateless). It implements the 2026-07-28 protocol revision using the official TypeScript SDK and also answers stateless 2025-era requests.

MCP endpoint

https://audon.ai/mcp

Authorization

OAuth 2.1 with PKCE (S256). Discovery: https://audon.ai/.well-known/oauth-protected-resource/mcp → authorization server metadata at https://audon.ai/.well-known/oauth-authorization-server.
Clients may identify with a Client ID Metadata Document (an https client_id) or register dynamically at /api/oauth/register.
On consent the user picks an organization and scopes. Granted scopes are always narrowed to the user’s current role; a role change or removal takes effect immediately. Access tokens last one hour; refresh tokens rotate, and reuse of a rotated token revokes the connection.
Clients without OAuth can send an API key: Authorization: Bearer aa_live_….

Tools

One tool per product capability — the same list as the REST operations. Tool annotations mark read-only and destructive tools. Results include both text and structuredContent.

Failures are explicit

A tool that can’t complete returns isError: true with a code: approval_required (with an approval URL), insufficient_scope, entitlement_required, insufficient_evidence, awaiting_external_consent.

Agents should relay these, not report success

An approval request or missing evidence is an answer in itself. Pass the code and any approval URL back to the person.

Example: audit, review, alert

MCP tool calls

audit_start          { "period_days": 30 }
audit_get            { "audit_id": "aud_…" }        # poll until status = completed
findings_list        { "financial_classification": "anomalous_spend" }
finding_get          { "finding_id": "fnd_…" }
alert_create         { "name": "Daily > $500", "metric": "daily_spend", "threshold_minor": 50000 }
outcomes_get_summary {}                              # "unavailable" until telemetry exists
optimization_create  { "title": "…", "description": "…", "change_type": "retry_policy", "rollback_plan": "…" }
optimization_submit  { "proposal_id": "opt_…" }      # an approver must decide

Resources

audon://methodology — definitions of every financial classification and formula.

What’s been tested

The repository’s test suite drives this endpoint with the official MCP TypeScript client: listing tools, starting and polling an audit, creating an alert, submitting an optimization for approval, and receiving insufficient_evidence instead of a false saving. Installation steps in specific consumer apps vary by client and plan and are not claimed here until tested.