MCP & AI agents

Waveband ships a Model Context Protocol (MCP) server so AI assistants and agents can operate your seat with the same scoped permissions as the REST API. Connect Claude, Cursor, or any MCP-capable client and ask it to launch campaigns, adjust budgets, or explain performance.

The server advertises itself at /.well-known/mcp.json for clients that support MCP discovery.

Connecting (developer tools)

{
  "mcpServers": {
    "waveband": {
      "url": "https://<your-host>/mcp",
      "headers": { "Authorization": "Bearer wbk_..." }
    }
  }
}

Tool availability follows your key's scopes: a key with reports:read only can answer questions but never touch budgets.

Hosted assistants (OAuth)

Hosted clients (claude.ai connectors, ChatGPT connectors) authenticate via OAuth instead of static keys — connect from the client's integration settings using your Waveband host; you will be asked to sign in and approve the requested scopes.

Guardrails

Write actions from agents obey the same permission policy as Autopilot automations: action grants, bounded budget changes, propose-vs-auto-apply modes, full decision logging, and one-click undo. Configure per key/automation in the console.

Available tools

Curated workflow tools cover workspaces, campaigns, line items, targeting, creatives, conversion events, reports, and Autopilot automations. The waveband_api escape hatch reaches every documented REST operation (see GET /api/v1/openapi.json) so agents are never blocked by a missing tool.

OAuth discovery

GET /.well-known/oauth-authorization-server
GET /.well-known/oauth-protected-resource
POST /oauth/register     # RFC 7591 dynamic client registration
GET  /oauth/authorize    # consent screen (console sign-in)
POST /oauth/token        # authorization_code + PKCE

Tokens are scoped to the intersection of the requested scopes and the approving user's own permissions — an analyst can never mint an agent token that writes campaigns.