# Connect an agent to Lessly

The platform speaks the Model Context Protocol at `https://mcp.lessly.com`, over JSON-RPC 2.0 on HTTP. There is one endpoint. What it offers depends entirely on who is calling and which product is selected — there is no separate URL per product.

## Connect a client

1. **Add `https://mcp.lessly.com` to the MCP client as a remote server.** Any client that implements MCP over HTTP works; nothing is Lessly-specific about the transport. Per-client configuration is on [MCP clients](/reference/mcp-clients).
2. **Give it a credential.** Two are accepted, and both are checked on every request:
   - **OAuth 2.1 authorization code flow** — the client opens a browser, you approve the request on a consent screen, and it receives a short-lived token automatically. This is the path for interactive clients.
   - **A static API key** — paste it into the client configuration as a bearer credential, `Authorization: Bearer lsk_dev_...`. This is the path for headless environments: CI, background agents, any client with no browser and no person to approve a consent screen. Create the key first — see [REST API and API keys](/interfaces/api-and-keys).
3. **Select the product** the agent should act on, unless the credential already pins one.

A key is checked on every single request and the result is never cached, so revoking a key stops the very next call that uses it.

A request with no credentials at all is answered with `401` and a `WWW-Authenticate` header pointing at the endpoint's OAuth metadata document (`https://mcp.lessly.com/.well-known/oauth-protected-resource`), so a client can discover how to authenticate. A request that *did* carry a credential and was rejected gets no such pointer: it has already chosen its mechanism, and the answer is that the credential is bad.

## Make the first call

Ask the agent for something read-only and see what comes back:

> "List the Lessly products I have access to."

The agent calls [`organization_product_list`](/reference/mcp-tools/organization_product_list) and returns your products with your role in each. The tool is user-scoped, so it answers before any product is selected.

To act on one product, select it:

> "Switch to Acme Store."

That is [`organization_product_select`](/reference/mcp-tools/organization_product_select) with the product's `id`. It verifies membership, records the choice for the session, and settles which organization is active, so the two cannot drift apart. `organization_list` and `organization_select` do the same for the organization.

The full catalog is on the [MCP tools reference](/reference/mcp-tools).

## Which tools the agent sees

Call `tools/list`. The response is the set of operations available to the authenticated identity in the currently selected product, already filtered by that identity's permissions — there is no separate catalogue to consult, and tools the caller may not use are not listed. Invoke one with `tools/call`, passing the tool name and its arguments; each tool carries a JSON Schema describing what it accepts.

Tools that only read are annotated as read-only. Tools that change something carry no such annotation, so a client that wants to be careful can treat anything unannotated as a mutation.

Names are flat and follow one pattern:

```text
<namespace>_<resource>_<action>
```

The namespace is the area of the platform. Action segments may contain hyphens (`list-members`, `list-invitations`); the underscores separate the three parts.

When a tool is renamed, the old name keeps working for one release cycle and is listed with a `DEPRECATED — use <new name>` prefix on its description.

## What a call is allowed to touch

| Tool kind | Needs | Example |
|---|---|---|
| User-scoped | Your identity only. Answers before any product is selected. | [`organization_product_create`](/reference/mcp-tools/organization_product_create) |
| Product-scoped | An active product as well. Rejected when no product is selected. | [`organization_product_list-members`](/reference/mcp-tools/organization_product_list-members) |

A static API key is minted for one specific product and cannot reach beyond it. A request presenting such a key while addressing a different product is refused rather than quietly redirected to the key's own product.

## Next steps

- [Create an API key for a headless client](/interfaces/api-and-keys): pinned to one product, shown once.
- [Browse the tool catalog](/reference/mcp-tools): every tool the platform publishes, with its arguments.
- [Configure your MCP client](/reference/mcp-clients): the config each client expects.