SMOC is now an API: MCP, REST, and opt-in writes

Written by: Kristoffer Kvam
September 11, 2026

One company-scoped invoke layer now powers two surfaces: AI clients use MCP, pipelines use REST v2, and the legacy contacts endpoint stays. Default keys are read-only. Check Allow limited writes when you mint a key, and the same tools can update contacts, lists, and tags — and send a text inbox reply.

What shipped

SMOC already had a Streamable HTTP MCP server on the same worker as the public API. Every domain tool is callable two ways:

MCP at https://v2.api.smoc.ai/mcp for Claude, Cursor, VS Code, and other MCP clients
REST v2 at POST /api/v2/{toolName} with the same JSON body

Policy, tenancy, rate limits, confirmation, and idempotency run once. A write that is blocked on MCP is blocked on REST.

GET /api/company/mongocontact is unchanged. Zapier keys stay read-only and keep the same path, token header, and response shape.

What you can read

Customer keys cover the company, not only contacts:

Contacts, stats, tags, and prospect lists
Company profile, assets, and CPCS crawl status
Studio catalog — versions, themes, targeting portfolios, generation and translation jobs
Flow analytics
LinkedIn inbox threads and message-flow conversations

A customer token cannot select another company. Super-user keys still pass companyId when they need to.

What write-enabled keys can do

Mint the key under Settings → Integrations → MCP or API and check Allow limited writes. Existing read-only keys do not gain writes until you create a new one with that box checked.

Contacts and lists

Create or update a contact
Create or rename a tag, assign or unassign it
Create or rename a prospect list, add or remove a contact

Company and crawl

Update company profile fields
Update company-asset basics
Add a CPCS URL to crawl

Studio metadata

Rename a flowchart
Update a recommendation's status (apply / reject — not publish)

Inbox

Archive a thread, mark it unread, or mark unanswered handled
Send a text-only reply with inbox_threads_send

Send needs threadId, body, and idempotencyKey. The key must be able to load that thread first; a missing or other-company thread returns not found. Retries with the same key do not double-send. Rate limit is 10 sends per minute. No attachments.

What still stays off customer keys

Write-enabled does not mean full admin.

Customer keys still cannot:

Delete contacts, tags, lists, companies, or assets
Publish a flow or toggle it live (flowcharts_set_active)
Create or duplicate a flowchart
Change targeting
Start credit-burning jobs (generation, crawl schedule changes)
Start a LinkedIn outreach campaign

Those stay super-user only. That is the line between “your AI can work in your company” and “your AI can take the product live.”

How to choose

Zapier / existing syncs: keep GET /api/company/mongocontact
Pipelines and scripts: POST /api/v2/{toolName} (Bearer or token)
AI clients: MCP, then skills_search if the tool name is not obvious

OpenAPI lives at GET /api/v2/openapi.json.

How to turn writes on

Console → Settings → Integrations → MCP (or API).
Generate a key. Check Allow limited writes.
Copy it once. Store it like any other secret.
Point the client at https://v2.api.smoc.ai/mcp with Authorization: Bearer <key>, or call POST /api/v2/{toolName}.
Ask the client to run whoami, then mcp_capabilities. The capability list tells you which writes that key can see.

If a tool is missing, mcp_capabilities names the permission. Inbox send needs inbox:write on a write-enabled key. Older keys without inbox scopes need a rotation.

Why this shape

We opened reads first so Claude and Cursor could see the company without a second API. We opened writes only where a mistake is recoverable: a tag, a list membership, a company URL, a text reply with an idempotency key.

We did not open publish, live toggle, deletes, or campaign send. Those burn credits or change what prospects see. They stay behind a human in Console — or a super-user token.

The same tools are on REST v2, so a script and an MCP client cannot drift.

Shipped this month — September 2026 release log.