API & Integration

WebSocket protocol, REST gateway, role-based access control, and real-time data synchronization.

WebSocket JSON-RPC 2.0

The primary communication protocol. Clients connect via WebSocket and exchange JSON-RPC 2.0 messages. Tool calls are request/response, notifications are server-push. The MCP handshake negotiates capabilities and protocol version.

Tool Calls

tools/call with name and arguments. The server validates input against JSON Schema, executes the tool, and returns structured results.

Notifications

Server pushes data_changed events when write tools modify data. Clients refresh their UI in real-time.

REST Gateway

Dynamic HTTP API that maps URL paths to MCP tool executions. Routes are configured at runtime via MCP tools. Authentication via API key header. Used by external consumers (BI dashboards, third-party integrations).

Dynamic Routes

Add, update, remove routes at runtime. Each route maps a URL path to a tool name with fixed arguments.

Export Sets

Bundle multiple tool calls into a named export set. Execute all at once and write results to individual JSON files.

RBAC

Role-Based Access Control with user management, role assignment, and per-plugin permissions. Sessions are tied to WebSocket connections. Admin, default, and service roles (llm_agent) are built-in.

Plugin Access

Each role defines which plugins are accessible. Tool calls are checked against the user's role before execution.

Report-Level RBAC

BI reports can restrict access by role. Enforced at data access time on the server, with client-side filtering for the web viewer.

Change Data Capture

Write tools automatically trigger CDC notifications. Each plugin maintains a data version counter. Connected clients receive notifications with plugin name and tool, enabling targeted UI refresh without polling.