# Aevah Model Context Protocol (MCP) Status: Production Canonical documentation: https://www.aevah.com/developers/mcp Connection documentation: https://www.aevah.com/developers/mcp-connection MCP surface: https://www.aevah.com/developers/mcp-surface ## Transport and authorization Aevah publishes platform capabilities as versioned, permission-scoped tools that enterprise agents discover and call over MCP. - Streamable HTTP — Production: Remote connections use Streamable HTTP with OAuth 2.1 bearer authorization. - stdio — Production: Available only for local development against a development tenant. - Legacy HTTP+SSE — Not Available: Not available. Aevah uses Streamable HTTP for remote MCP connections. ## Endpoint discovery Each licensed customer receives an administrator-issued MCP connection for its own Aevah instance. The exact endpoint and discovery metadata are available only inside the authorized environment. They are not listed publicly, shared across customers, or exposed through a guessable directory. ## MCP primitives - Tools — Production: The primary surface. Every Aevah capability reaches agents as a tool. - Resources — Production: Read-only governed artifacts, including audit records, proposals, and version history, addressed by stable URI. - Prompts — Production: Curated task templates for common stewardship and discovery flows. - Notifications — Production: Tool-list changes and progress for long-running operations. - Sampling — Not Available: Not available by design. Aevah does not request inference from the connecting client; model access inside Aevah is separately governed and administrator-granted. - Elicitation — Not Available: Not available by design. Consequential actions return a proposal for human approval or require explicit prior confirmation. ## Tool classes - read: Returns data and changes nothing. It executes directly under the caller's permissions. - propose: Produces a change proposal a human must approve. It changes nothing on its own. - execute: Performs a governed change under explicit prior confirmation. Permissions are reauthorized at execution. An agent cannot promote itself between read, proposal, and write classifications, and no tool bypasses the approval path governing the same action in the user interface. ## Tool families - Catalog discovery: Returns the tools, versions, classifications, and permissions available to the caller. - Data navigation: Returns authorized entities, relationships, definitions, and business context. - Quality intelligence: Returns quality standards, failed checks, affected records, and supporting evidence. - Matching and survivorship insight: Returns candidate records, comparisons, proposed outcomes, and the evidence available for review. - Governance memory: Returns definitions, policies, ownership, decisions, approvals, and audit history. - Publication and activation: Returns publication status, eligible targets, activation outcomes, and correlation identifiers. - Operations: Returns operation status, progress, cancellation state, and per-record outcomes. ## Permission-filtered discovery The public website describes tool classes and families rather than publishing the complete catalog. Inside an authorized connection, the permission-filtered tool list is the source of truth for the capabilities available to that caller. tools/list is filtered to the caller's effective permissions. Unauthorized tools do not appear. Catalogs can differ between callers and change when access changes. Clients refresh the catalog on connection and after a tool-list-changed notification; they do not cache a catalog across identities or sessions. ## MCP Apps When an agent reaches a decision only a person should make, Aevah hands back a usable interface rather than a wall of JSON. An agent proposing a merge returns a review surface showing the candidate records side by side, which attribute value wins and why, and approve or reject controls — rendered directly in the agent's own environment. The person decides on real evidence, in context, and the decision is captured in the audit trail. The interface is a rendering surface, never an authority: every approval is reauthorized against the approver's permissions before anything changes, and the surface never receives values the viewer is not cleared to see. Review surfaces cover merge and match review, survivorship explanation, data quality triage, mapping suggestion review, and generic proposal approval. ## Delegated identity An agent acts with the identity and permissions of the person who triggered it, never beyond them. Each tool call is re-evaluated against the caller's effective permissions. A tool the caller cannot invoke is absent from the tool list. ## Tool versioning Breaking changes publish a new tool version; existing versions are never altered. Deprecation is signalled in tool metadata with a replacement pointer. ## Classification and audit Every call is authorized, classified, and audited, regardless of outcome. Audit records do not contain argument values, returned payloads, or field-level customer data. They record that a call occurred, by whom, under what authority, and to what effect. Customers can retrieve their audit records through the platform and as an MCP resource. ## Immutable record history Governed changes are immutable and cumulative. A change creates a new record version; nothing is overwritten or erased. Prior versions remain retrievable, any two versions can be compared field by field, and every version is attributable to a principal and tool call. Reverting is a forward operation that supersedes the current version with a new version carrying earlier values, preserving the complete change history. ## Public discovery boundary Aevah serves discovery metadata inside licensed customer environments. The public website does not reveal its exact path or contents. Connection details are administrator-issued for the customer's own instance.