XYVENRAby Ouroboros
Xyvenra docs

MCP

The remote MCP server is POST https://xyvenra.com/api/mcp. Use OAuth 2.1 first. A platform API key is the fallback.

Connect

The official registry listing is io.github.LAHutchins91/xyvenra, version 0.1.1. It points at https://xyvenra.com/api/mcp and does not require an Authorization header. Icons are icon.svg and apple-icon.png. The website is https://xyvenra.com.

OAuth 2.1 uses protected-resource metadata, authorization-server metadata, dynamic client registration, PKCE S256, and scope xyvenra. Consent reuses GitHub or Google sign-in. An access token is bound to the same account as a platform key.

Fallback: a person signs in and creates a key at https://xyvenra.com/app/keys. The plaintext secret is shown once. Prefix xyv_plat_. Send it as Authorization: Bearer xyv_plat_.... Early access limit: 60 requests per minute. Agents cannot complete signup or key creation in a browser.

Directory discovery

initialize, ping, notifications/initialized, tools/list, prompts/list, and resources/list answer without a token. The tool list is public. Prompts and resources are empty. tools/call and every other method require OAuth or a platform API key. A missing or rejected token returns HTTP 401 with WWW-Authenticate pointing at the protected-resource metadata above. Those responses contain no account data.

Server card: https://xyvenra.com/.well-known/mcp/server-card.json. The same JSON is also at /api/mcp/.well-known/mcp/server-card.json. It lists the live tools and marks OAuth 2.0 or a bearer key as required for calls.

Tools

  • create_project — Cloud site (name and slug), Data project, Studio app, or Mobile Expo starter. product: code is an error and points at /app/code. Nothing is deployed or charged.
  • list_projects — owned Cloud, Data, Studio, or Mobile rows. Code returns the browser-workspace note.
  • project — get reads a Cloud page, Studio source, or Mobile draft. save replaces Studio source or a Mobile draft. A Mobile save requires expectedUpdatedAt from the last get or save. Saving does not publish a site or start an EAS build. Cloud HTML is published with deploy.
  • deploy — publish self-contained HTML, or a saved Studio page when projectId is passed instead of html. Public env vars for that site are written into the page. Private values are not.
  • export — Studio source ZIP, Mobile Expo ZIP, or Data JSON snapshot. The Mobile ZIP does not start an EAS build.
  • env_vars — list, set, update, or delete. exposure is secret by default or public. Only public values are copied into a Cloud page.
  • database — list_tables, create_table, delete_table, list_records (filter, search, order, limit, offset, or cursor over the latest 250 rows), list_changes, get_record, create_record (one data object or a records batch of 1 to 250), update_record (optional expectedUpdatedAt), and delete_record. Field changes stay in the Data app.
  • files — list, upload, download, or delete private Data files. Uploads are base64, at most 1 MB, within 100 files and 50 MB per account.
  • eas_dispatch — dispatch one workflow on the customer’s Expo project with the Expo token supplied for that call. The token is not stored. Xyvenra does not pay Expo.
  • guidance — ask once about a real next step. Decline turns a path off. continue creates only the step you name. It does not deploy or charge.
  • status — Code, Cloud, Data, Mobile, and Studio for this account.

Limits

  • Cloud publishes static HTML (180 KB) or a static-site ZIP through a Cloud deploy key. It is not a Node or Next.js host. There is no server runtime.
  • Env values are stored for the account. Secret is the default. A Cloud publish writes public values into the static page and leaves private values out.
  • Data is projects, typed tables, records, a record poll, and private files. It is not Supabase Auth, a public storage bucket, Realtime, or Edge Functions. Project API keys (xyv_data_) are created in the Data app.
  • Paid Cloud, Data, Mobile, and Studio plans are still coming soon. This server does not take payment.

Terms: https://xyvenra.com/terms. Privacy: https://xyvenra.com/privacy. REST examples stay on the API reference.