Overview
Most MCP docs describe connecting external tools into an EKB agent. This section is the other direction: expose EKB itself as MCP servers so any MCP-compatible client — Claude, Cursor, ChatGPT, or a custom agent — can build and use your workspace.
| Direction | What you do | Docs |
|---|---|---|
| MCP in EKB | Add Sentry, New Relic, Power BI, or a custom MCP server on an agent’s MCP tab | MCP in EKB |
| EKB as MCP | Point Claude / Cursor / ChatGPT at EKB’s MCP URLs so those clients drive EKB | This section |
Prerequisites
- An EKB account with access to at least one project
- An MCP client that supports HTTP MCP URLs and OAuth (or custom headers for API keys)
- For production-style hosts, network access to your environment’s MCP hostname (for example
https://mcp.getodin.ai) - For headless CI, a user-level API key and secret
Two servers, two kinds of access
EKB publishes two MCP endpoints. They are separate on purpose: asking a support agent a question is a smaller grant than letting a client create or rewrite agents, so they do not share a consent screen or a token.
| Endpoint | Server | Consent label | Scope | What the client can do |
|---|---|---|---|---|
/builder/mcp | EKB Builder | Build in your workspace | odin:build | Create and modify agents, workflows, smart tables, interfaces, and knowledge bases — the same toolkit surface Autopilot uses |
/runtime/mcp | EKB Runtime | Use your agents and tools | odin:use | Ask existing agents, run published tools, search a knowledge base, and query smart tables |
A token issued for Runtime cannot be reused on Builder, and vice versa. “Use” access cannot escalate into “build” access.
On the consent screen, EKB names the MCP client and the permission it is requesting. Nothing is granted until you approve or deny. Declining returns access_denied to the client instead of leaving it hanging.
When to use which
| Goal | Use |
|---|---|
| “Build me an agent / workflow from Cursor” | Builder |
| “Ask our support agent” / “Run this published tool” | Runtime |
| “Search the project knowledge base” | Runtime |
| “Read rows from a smart table” | Runtime |
| Connect a vendor MCP into an EKB agent | MCP in EKB |
How access is limited
Three layers always apply:
- Audience — the token is valid only for the server you authorized (Builder or Runtime)
- Scope —
odin:buildvsodin:use - Your EKB permissions — the client acts as you; project membership, Access Tags, and publish state still apply
The MCP service holds no credentials of its own. Every call forwards your OAuth token or API key.
Next steps
- Connect a client — add Builder and/or Runtime URLs
- Authentication — OAuth consent, scopes, and API keys for CI
- Builder or Runtime — what each server exposes