Feature
MCP server
The SignalDeck MCP server lets approved agents and automations operate inside the same RBAC envelope as a human — list workspaces, create posts, fetch approvals, and generate report drafts without bypassing scopes, without skipping audit, and without escalating permissions.
MCP surface
Agents that work within your rules.
Scoped tool calls
Every MCP tool call carries the scopes of the API key or session it was launched under. A tool can never escalate beyond what the caller is already allowed to do.
RBAC, not bypass
An agent calling create_post obeys the same approval rules a human would: drafts land in the right approval state, never auto-publishing past required reviewers.
Destructive actions require confirmation
Deletes, role changes, and bulk operations require an explicit confirm token. Agents can plan and propose, but a human or signed automation has to confirm the irreversible step.
Every call is audited
Agent tool calls produce the same audit events human actions do — actor, scope, target, payload, timestamp. Agent activity is visible in the same audit log as human activity.
Provider capability awareness
Tools like create_post run the same capability validation a human's calendar entry would. An agent can't schedule a post a platform won't accept.
Memory respects workspace boundaries
Brand voice memory and campaign memory used by agents are workspace-scoped. Nothing leaks across workspaces, even when the same agent is connected to multiple.
Implemented tools
What ships in the MCP server today.
list_workspaces
Enumerate the workspaces this caller can see, with role and scope per workspace.
create_post
Draft a post into a workspace's calendar with capability validation and approval routing.
upload_media_from_url
Pull a remote asset into the workspace media library with scan, processing, and licensing metadata.
get_calendar
Read scheduled and shipped posts with status, channel, and approval state.
get_pending_approvals
List approval items waiting on the caller or a named approver.
draft_reply
Draft a reply for an inbox thread — never sends; queues for human acceptance.
get_analytics
Pull metric rollups with source and freshness metadata preserved.
generate_client_report
Produce a report draft with cited metrics, disclosed gaps, and white-label-ready output.
Why this matters
Agents should work, not surprise you.
An agent that bypasses your approval rules is an incident waiting to happen. SignalDeck's MCP server runs agents inside the same accountability surface as humans — same audit, same RBAC, same confirmation gates on destructive work.
FAQ
Frequently asked
Which MCP clients work?
Any compliant MCP client. The server speaks standard MCP transports and ships an example wiring for Claude Desktop, Cursor, and direct HTTP.
Can an agent publish without a human?
Only if the workspace policy allows it for the role/scope the agent runs under. Default policy requires human acceptance for sensitive actions and publication.
How do I see what an agent did?
Every tool call appears in the workspace audit log alongside human actions. Filter by actor type to see only agent activity.
Bring agents in safely
Try MCP against a real workspace.
Scoped, audited, and never publishing past your rules.