Driving Vixtur from outside

The “API keys” screen in your account settings issues a key. It starts with vx_ and is shown once only — all we keep is a hash of it, so there is no screen to go back to and read it from.

The key travels in the x-api-key header and identifies you as the user. Every ownership check still applies: a key is a way in, not a way around.

The MCP server

The project ships an MCP server that lets an agent — Claude Code, Cursor, anything that speaks MCP — drive the system. It works against the same API the browser works against, not a second route into the database.

• list_apps — the projects this key owns, with the address and code of each
• create_app — a new, empty project
• build_app — a build or a change, from a free-text description
• get_app — the files, the tables with their permissions, the versions and the conversation
• read_records — reading records, as the owner
• list_templates — browsing the template catalogue
• use_template — copying a template into a new project
• search_skills — searching the Israeli knowledge library

Revoking a key stops everything using it immediately. A revoked key and a key that never existed get exactly the same answer.