API Keys & MCP

Overview

Strata exposes a Model Context Protocol (MCP) endpoint that lets AI assistants read your content architecture directly. An AI tool connected via MCP can list your projects, inspect content types and fields, retrieve the full manifest, review pending changes, and more — all without leaving your editor or chat session.

Access to the MCP endpoint is controlled by API keys, which you create and manage in your organization's settings.

Creating API keys

API key management is available to organization owners only. To create a key:

1. Go to your organization's Settings → API Keys page.
2. Click Create key.
3. Give the key a descriptive name (e.g. “Claude Code — Main Project”).
4. Choose a project scope — restrict the key to a single project, or allow access to all projects in the organization.
5. Click Create key to generate it.

The full key is shown only once after creation. Copy it immediately and store it somewhere safe — Strata stores a SHA-256 hash of the key, so it cannot be retrieved later. The key prefix (first 10 characters) is displayed in the key list for identification.

Managing keys

The API Keys settings page lists all active and revoked keys for your organization. For each active key you can see:

• Name — the label you gave the key
• Prefix — the first 10 characters (e.g. sk_a1b2c3...)
• Scope — “All projects” or the name of a specific project
• Last used — the date of the most recent authenticated request

To revoke a key, click the trash icon next to it and confirm. Revocation takes effect immediately — any MCP client using the key will start receiving 401 errors. Revoked keys cannot be reinstated; create a new key instead.

Key scopes and project access

Every API key is scoped to your organization. Within the org, you choose the project visibility when you create the key:

• All projects — the key can access every project in the organization. If new projects are created later, the key automatically sees them.
• Single project — the key is locked to one specific project. MCP tools will only return data for that project, and requests for other project slugs will return “not found”.

All keys are created with read scope. This grants read-only access to project data through the MCP tools — keys cannot modify your content architecture.

The MCP endpoint

Strata's MCP endpoint implements the Model Context Protocol using the Streamable HTTP transport. The endpoint URL is:

https://your-domain.stratahq.app/api/mcp

The exact URL for your organization is shown on the API Keys settings page, ready to copy.

The endpoint accepts GET, POST, and DELETE requests as required by the MCP Streamable HTTP transport specification.

Authentication

Authenticate every request with a Bearer token in the Authorization header:

Authorization: Bearer sk_your_api_key_here

Requests without a valid key receive a 401 JSON-RPC error response. Keys that have been revoked or expired are rejected the same way.

Connecting an MCP client

Claude Desktop

Add the following to your Claude Desktop MCP configuration file (claude_desktop_config.json):

{
  "mcpServers": {
    "strata": {
      "url": "https://your-domain.stratahq.app/api/mcp",
      "headers": {
        "Authorization": "Bearer sk_your_api_key_here"
      }
    }
  }
}

Claude Code

Add the server with the CLI:

claude mcp add strata \
  --transport streamable-http \
  https://your-domain.stratahq.app/api/mcp \
  --header "Authorization: Bearer sk_your_api_key_here"

Cursor

In Cursor's settings, add a new MCP server with the endpoint URL and set the Authorization header to Bearer sk_your_api_key_here.

Rate limiting

The MCP endpoint is rate-limited to 120 requests per minute per API key. Each key is limited independently, so multiple keys on the same organization do not share a budget.

When the limit is exceeded, the endpoint returns a 429 JSON-RPC error with a Retry-After header indicating how many seconds to wait. MCP clients that respect this header will back off automatically.

Available MCP tools

The following tools are exposed through the MCP endpoint. All return JSON data.

Tools that take a project_slug parameter will only return data for projects the key has access to. If the key is scoped to a single project, other slugs return a “not found” error.

MCP resources

The MCP server also exposes read-only resources that AI assistants can reference for context:

MCP prompts

Two built-in prompts are available for common workflows:

Both prompts take a project_slug parameter and return a pre-built prompt with the project's full manifest embedded, ready for the AI assistant to analyze.

Security notes

• API keys are hashed with SHA-256 before storage. Strata never stores the raw key.
• Keys grant read-only access — they cannot create, update, or delete entries.
• Only organization owners can create, list, or revoke keys (requires the org:settings permission).
• The validation endpoint is not exposed as a Server Action — it is only reachable from the MCP route handler, preventing unauthenticated probing.
• Revoked or expired keys are rejected immediately. The lastUsedAt timestamp is updated on each successful authentication so you can monitor activity.

Next steps

• Read the Manifest & Export docs to understand the data format returned by get_project_spec
• Learn about Content Architecture for details on entity types, fields, and tab types
• Set up Team Collaboration with roles and permissions