Interfaces

The platform speaks the Model Context Protocol at https://mcp.lessly.com, over JSON-RPC 2.0 on HTTP. There is one endpoint. What it offers depends entirely on who is calling and which product is selected — there is no separate URL per product.

Connect a client

1. Add https://mcp.lessly.com to the MCP client as a remote server. Any client that implements MCP over HTTP works; nothing is Lessly-specific about the transport. Per-client configuration is on MCP clients.
2. Give it a credential. Two are accepted, and both are checked on every request:
   • OAuth 2.1 authorization code flow — the client opens a browser, you approve the request on a consent screen, and it receives a short-lived token automatically. This is the path for interactive clients.
   • A static API key — paste it into the client configuration as a bearer credential, Authorization: Bearer lsk_dev_.... This is the path for headless environments: CI, background agents, any client with no browser and no person to approve a consent screen. Create the key first — see REST API and API keys.
3. Select the product the agent should act on, unless the credential already pins one.

A key is checked on every single request and the result is never cached, so revoking a key stops the very next call that uses it.

A request with no credentials at all is answered with 401 and a WWW-Authenticate header pointing at the endpoint’s OAuth metadata document (https://mcp.lessly.com/.well-known/oauth-protected-resource), so a client can discover how to authenticate. A request that did carry a credential and was rejected gets no such pointer: it has already chosen its mechanism, and the answer is that the credential is bad.

Make the first call

Ask the agent for something read-only and see what comes back:

“List the Lessly products I have access to.”

The agent calls organization_product_list and returns your products with your role in each. The tool is user-scoped, so it answers before any product is selected.

To act on one product, select it:

“Switch to Acme Store.”

That is organization_product_select with the product’s id. It verifies membership, records the choice for the session, and settles which organization is active, so the two cannot drift apart. organization_list and organization_select do the same for the organization.

The full catalog is on the MCP tools reference.

Which tools the agent sees

Call tools/list. The response is the set of operations available to the authenticated identity in the currently selected product, already filtered by that identity’s permissions — there is no separate catalogue to consult, and tools the caller may not use are not listed. Invoke one with tools/call, passing the tool name and its arguments; each tool carries a JSON Schema describing what it accepts.

Tools that only read are annotated as read-only. Tools that change something carry no such annotation, so a client that wants to be careful can treat anything unannotated as a mutation.

Names are flat and follow one pattern:

<namespace>_<resource>_<action>

The namespace is the area of the platform. Action segments may contain hyphens (list-members, list-invitations); the underscores separate the three parts.

When a tool is renamed, the old name keeps working for one release cycle and is listed with a DEPRECATED — use <new name> prefix on its description.

What a call is allowed to touch

A static API key is minted for one specific product and cannot reach beyond it. A request presenting such a key while addressing a different product is refused rather than quietly redirected to the key’s own product.

Next steps

• Create an API key for a headless client: pinned to one product, shown once.
• Browse the tool catalog: every tool the platform publishes, with its arguments.
• Configure your MCP client: the config each client expects.