Integrations

For the integrator connecting another system to the fleet.

After reading it you can point a client at the record, prove who that client is, and read what comes back.

Before you start: an installed machine serving the record.

Three integration surfaces ship today, and they answer different questions:

⚠ All three are reads. None of them gates, merges or dispatches — those acts have their own doors with their own human decisions.

In one paragraph

saphan server is the fleet record's third projection — the same compositions the fleet show / wave show / ledger show / board export CLI verbs run, served over the Model Context Protocol so any MCP client can read the fleet. Its model rests on four decisions. Projection, not a brain — the server adds zero read paths of its own, holds zero cache, and re-reads the record on every request, so a served payload can never diverge from the CLI's. Read-only without exception — the eleven tools are all reads; mutating tools do not exist, not even as stubs, and the wire says so in as many words. Fail-closed authorization — the HTTP transport sits behind a bearer middleware validating signature, expiry, audience, claims and actor binding; a caller with no resolved scope is denied every class-gated tool, and unrestricted access exists only as one named, greppable constructor on the local stdio path. Refusal, not silence — an oversized response, an unknown tool, an unknown argument value, an ambiguous bind address are all named refusals with the exact next move spelled out; nothing is silently truncated, clamped, or guessed.

What this server is — and is not

It is a read surface for agents and humans. An MCP client connects and can answer, from the record alone: what streams exist and in what state, what the last human gate on each decided, whether an executor is alive, what a stream has cost against its quote, and what the persisted board looks like as an artifact. The payloads are byte-identical to the CLI's --json output, after the redaction the HTTP path applies, which is enforced by a conformance scenario on the real binary, not promised in prose.

It is not a control surface. There is no tool that gates, merges, runs, casts, or captures. The server's own initialize response says: "Mutating operations (gate/merge/run/capture) do not exist here — use the CLI." This is a product invariant, not a version-one gap: writes go through the CLI, where they meet the signing and gate discipline described in Security. A single governed write channel (one sequencer for board and ledger writes) is designed and recorded as direction of travel — but nothing of it is in this release.

It is deterministic. No request path calls a model. PKCE and JWT verification are cryptographic and boolean; projection is composition and rendering. Code that never calls a model cannot be talked into anything.

The MCP server has its own section

The read-only MCP projection is not an integration among others — it is a surface of its own, with its own transports, its own authorization and its own budget. It lives at MCP server.

What this section does not cover

⚠ Notices out to a chat destination are a separate surface — Notifications. ⚠ The MCP surface has its own section with the transports, the tools and the budget: MCP server. ⚠ Nothing here writes to another system; both surfaces are reads.