Internal application API
The application uses capability-based HTTP calls. Every call runs through validation, permissions and business rules. This route uses the person’s application session; it is not a public bearer-token API.
Connected assistants (MCP)
Mr B offers a remote MCP server for builders’ own assistants: OAuth 2.1 with PKCE, client ID metadata documents, tokens bound to the MCP address (audience), protected resource metadata and a read-only tool set. Each connection is bound to one person and one company, checked against the person’s current role on every call, and revocable.
Not offered
There are no API keys, no machine-only (client credentials) tokens and no public SDK. Assistants can't change records directly: with the separate drafts scope they can only record drafts a person accepts in Mr B. Files and drawings are not available through assistants.
Keep decisions in Mr B
Assistants and agents cannot confirm scale or measurements, approve estimates, issue or send client quotes, or post or pay money. The server enforces this, including for connections authorised by an Owner.