Developer documentation

Agent integrations (MCP)

Monipler ships a Model Context Protocol (MCP) server so AI clients such as Claude, ChatGPT, Cursor, and the Lovable agent can read your carousel projects and brand kits on your behalf — after you explicitly approve them.

Endpoint

Add Monipler as a remote MCP server using this URL:

https://monipler.com/mcp

Transport is MCP Streamable HTTP. Authorization metadata is published at /.well-known/oauth-protected-resource, so compliant clients discover the sign-in flow automatically — you should never need to paste a token by hand.

Available tools

All four tools are read-only. Nothing in the MCP server creates, edits, or deletes content in your workspace.

echoEchoRead-only · no data access

Echoes back the text you send. Use it to confirm the connection and your sign-in are working.

Input
text (string, required)
Returns
The same text.
list_carouselsList carousel projectsRead-only · your carousel projects

Lists your carousel projects (id, title, platform, status, updated_at), newest first.

Input
limit (1–50, default 20), status (draft | in_review | approved | exported | archived, optional)
Returns
An array of carousel project summaries.
get_carouselGet carousel projectRead-only · one carousel project + slides

Fetches a single carousel project by id together with its slides in display order.

Input
id (uuid, required)
Returns
The project record and an ordered array of slides.
list_brand_kitsList brand kitsRead-only · your brand kits

Lists your brand kits with colors, fonts, and which one is set as default.

Input
limit (1–50, default 20)
Returns
An array of brand kit records.
create_carousel_draftCreate carousel draftWrite · creates a draft in your workspace

Creates a new draft carousel project in your workspace, optionally attaching a brand kit (your default kit if none is given) and setting the tone/editorial intent.

Input
title (required), platform (linkedin | instagram | twitter | generic), aspect_ratio (1:1 | 4:5 | 3:4 | 9:16), carousel_type, brand_kit_id (uuid, optional), tone (educate | persuade | case_study | announce | pov | how_to | recruit | lead_magnet), intent (custom text, overrides tone), notes
Returns
The new project record, including its id and resolved brand kit and intent.

Permissions and data scope

  • Authentication is required. Every tool call must carry a valid access token issued through the Monipler OAuth flow. Calls without one are rejected.
  • You only ever see your own data. Tool calls run against the database as the signed-in user, so the same row-level security rules that protect the web app apply to the MCP server. No administrative or service-level credentials are used.
  • Read-only. The exposed tools perform SELECT queries only — carousel projects, slides, and brand kits. Billing details, payment records, team member data, and account settings are not exposed.
  • Session tokens are not accepted. Only tokens minted by a registered OAuth client work; copying a browser session token will not authenticate a client.
  • Plan limits still apply. Tools return only the content your account can already access in the app.

How the OAuth consent flow works

Monipler uses OAuth 2.1 with PKCE and dynamic client registration. The first time a client connects, this is what happens:

  1. 1. Discovery. Your AI client calls /mcp without a token and receives a 401 pointing at Monipler’s protected-resource metadata, which names the authorization server.
  2. 2. Client registration. The client registers itself automatically — no client ID or secret for you to create or paste.
  3. 3. Sign in. A browser window opens on Monipler. If you are not already signed in, you land on the Monipler sign-in page and are returned to the consent screen afterwards.
  4. 4. Consent. You see a screen at /.lovable/oauth/consent naming the requesting application and what it will be able to read. Nothing is shared until you press Approve; Deny ends the flow immediately.
  5. 5. Token exchange. After approval the browser redirects back to your client, which exchanges the authorization code for a short-lived access token plus a refresh token. Tokens refresh silently, so you normally approve a given client only once.
  6. 6. Authenticated tool calls. Every subsequent call sends that token, and Monipler resolves it to your user identity before touching any data.

Revoking access

Remove the connector from your AI client to stop it calling Monipler. To be certain a client can no longer reach your data, sign out of all sessions from Monipler settings or contact support to have the authorization revoked server-side — a denied or revoked client must run the consent flow again before it works.

Troubleshooting

  • “Unauthorized” on every call. The client is sending no token or an expired one. Reconnect the integration to re-run consent.
  • Empty results. You are signed in as an account with no carousel projects or brand kits yet — create one in the app and retry.
  • Consent screen shows an error. Authorization requests expire. Start the connection again from your AI client to get a fresh one.
  • Client cannot find the server. Confirm the URL is exactly https://monipler.com/mcp and that your client supports remote MCP over Streamable HTTP.