MCP Server
Your scheduler, as a tool
your AI assistant can use
Milvaion exposes 32 tools over the Model Context Protocol. Point an AI coding assistant at it and diagnose a failing pipeline by asking questions, with exactly the level of access you decided when you created the api key.
Set it up in two minutes
Create a read-only api key in the dashboard, then register the server in your client.
claude mcp add --transport http milvaion \ https://milvaion.acme.com/mcp \ --header "X-ApiKey: $MILVAION_API_KEY"
{
"mcpServers": {
"milvaion": {
"type": "http",
"url": "https://milvaion.acme.com/mcp",
"headers": {
"X-ApiKey": "${MILVAION_API_KEY}"
}
}
}
}Keep the key out of the repository — most clients support environment variable substitution in the config, and an .mcp.json with a live key in it will eventually be committed.
Supported clients
Any client that speaks streamable HTTP works. What differs is the config file and, unhelpfully, the key names — getting those wrong is the usual reason a client connects but lists nothing.
| Client | Config | Notes |
|---|---|---|
| Claude Code | claude mcp add, or .mcp.json | Accepts localhost. Easiest way to try it. |
| Cursor | .cursor/mcp.json | mcpServers key, url field. |
| VS Code / Copilot | .vscode/mcp.json | servers key, not mcpServers. Agent mode required. |
| Windsurf | ~/.codeium/windsurf/mcp_config.json | serverUrl field, not url. |
| Gemini CLI | ~/.gemini/settings.json | httpUrl field. Expands ${VAR} from the environment. |
| Claude Desktop | Connectors UI | Ignores HTTP entries in the config file. Needs HTTPS. |
| ChatGPT | Connectors UI, developer mode | HTTPS only. Write tools need a Business or Enterprise workspace. |
Full config snippets for each of these are in the setup guide.
What it can do
Thirty-two tools. You do not choose which ones to expose — you choose what the api key is allowed to do, and the assistant sees the rest as permission errors.
Reading — 15 tools
- Jobs, schedules and tags
- Executions with status and duration
- Logs and exceptions per execution
- Dead letter failures
- Workers and heartbeat health
- Workflows, runs and per-step outcomes
- Activity log — who changed what
Acting — 17 tools
- Trigger a job or workflow now
- Cancel a running execution
- Pause and resume without deleting
- Configure auto-disable thresholds
- Create and edit jobs and workflows
- Resolve dead letter records with notes
- Delete, for the rare case it is right
Users, roles, permissions, api keys and dispatcher control have no tools at all and are unreachable over MCP regardless of what the key is granted.
How the access model works
Authentication at the endpoint
/mcp requires a valid credential. An anonymous request never reaches a tool.
Authorization per tool
Each tool checks its own permission. A key without Trigger gets an error naming exactly what it lacks.
Attribution on every change
Anything triggered or cancelled through MCP is recorded with the key's name, so history separates machine from human.
Treat write permissions as production access. Trigger lets an assistant cause real work to run. Update lets it change when your jobs run. Delete is irreversible. The tools tell the model to confirm first and to prefer pausing over deleting, but those are prompts, not guarantees. For anything that matters, a read-only key is the right answer.
Frequently asked questions
Does Milvaion send my data to an AI provider?+
No. Milvaion is an MCP server, which means it is the data source. The model runs in your editor - Claude Code, Cursor, Copilot - on your own subscription, and that editor decides what to send to its provider. Milvaion stores no OpenAI, Anthropic or Google credentials and makes no outbound calls to any of them.
What does it cost?+
Nothing on the Milvaion side. It is open source under Apache 2.0 and the MCP server is part of the API, not a paid add-on. There are no tokens consumed server side because no model is ever called from Milvaion.
Can an assistant break my production schedule?+
Only if you let it. Every tool is gated by the same permissions your users have. An api key granted just List and Detail exposes the fifteen reading tools and nothing else, so the assistant can investigate any incident and change nothing. Trigger, update and delete each require their own permission.
Which clients work with it?+
Anything that speaks the Model Context Protocol over streamable HTTP: Claude Code, Cursor, VS Code with GitHub Copilot, and others. Claude Code accepts a localhost URL directly, which makes it the quickest way to try this against a local instance.
Do I need to expose Milvaion to the internet?+
No. The MCP client runs on the developer's machine and connects to whatever address that machine can already reach - localhost during development, an internal hostname on a company network. A public URL is only needed for clients that require one, such as adding it as a connector in a hosted chat product.
Does it work behind a reverse proxy?+
Yes, but the proxy must not buffer responses - the transport uses server-sent events. In Caddy that means flush_interval -1; in nginx, proxy_buffering off. A client that connects but lists no tools is almost always a proxy buffering the stream.
Try it against a local instance
Start the stack with Docker Compose, create a read-only api key in the dashboard, and point Claude Code at http://localhost:5000/mcp. No public URL and no HTTPS needed to see it working.