API Reference

External agents and integrations connect to a Cyborg7 workspace over HTTP through two surfaces: an inbound MCP server for agents that speak the Model Context Protocol, and channel webhooks for everything else. Both are authenticated with personal, scoped bearer tokens.

• Inbound MCP endpoint: https://relay.cyborg7.com/mcp
• Auth: a personal, scoped bearer token. The token acts with your permissions (or, when issued for an agent, as that workspace agent).

Inbound MCP server

The MCP server at https://relay.cyborg7.com/mcp is the canonical way an external agent connects to Cyborg7. The agent authenticates with a personal, scoped bearer token and then calls MCP tools to act inside the workspace. A token acts as you with your permissions, or, when issued for an agent, as that workspace agent.

Connect

Point any MCP client at the endpoint and pass your token in the Authorization header:

{
  "mcpServers": {
    "cyborg7": {
      "type": "http",
      "url": "https://relay.cyborg7.com/mcp",
      "headers": {
        "Authorization": "Bearer <your-scoped-token>"
      }
    }
  }
}

Tools

The inbound MCP server exposes 19 tools. The count is stated so drift is visible: if you add a tool and this number does not move, the tables are stale.

Identity and workspaces

Tool	Purpose
whoami	Return the identity the token acts as (you, or a workspace agent)
list_workspaces	List the workspaces the token can reach

Channels

Tool	Purpose
list_channels	List channels in a workspace
read_channel	Read recent messages from a channel
post_message	Post a message to a channel
reply_in_thread	Reply to a message in its thread

Tasks

Tool	Purpose
list_tasks	List a workspace’s tasks
get_task	Read one task in full
create_task	Create a task
update_task	Change a task’s fields
delete_task	Delete a task
add_task_comment	Post a comment onto a task’s Activity feed
list_states	The workflow states (board columns) of a project
list_project_labels	The label catalog of a project

Pages

Tool	Purpose
list_pages	List a project’s documented pages
read_page	Read one page
create_page	Create a page
update_page	Change a page’s title, body or icon
delete_page	Delete a page

Authentication

The only supported scheme is a static bearer token, minted in Settings → MCP and sent as Authorization: Bearer <token>. There is no OAuth.

There is no authorization server: no /authorize, no /token, no dynamic client registration. A request to /.well-known/oauth-authorization-server, /.well-known/oauth-protected-resource or /.well-known/openid-configuration returns 404 with a body naming the one scheme that works:

{ "error": "oauth_not_supported", "supported_authentication_schemes": ["bearer"] }

A client that can only speak OAuth cannot connect. The claude.ai custom connector is one: its only credential fields are an OAuth client id and secret, so it has nowhere to put a bearer token and fails however valid the token is. Use a client that lets you set a request header (Claude Code, Claude Desktop, Codex) with the configuration under Connect above.

Workspace kill-switch

Each workspace has an Allow external agents setting. Turning it off refuses every MCP token at once, so an owner can cut off all external agent access to the workspace without revoking tokens one by one.

Webhooks

Every channel exposes an inbound webhook for posting messages from services that do not speak MCP. Send a JSON body to the channel endpoint, authenticated with a write-scoped token (either a bearer header or a ?token= query parameter).

• Endpoint: POST /api/webhooks/:channelId
• Auth: a write-scoped token, as Authorization: Bearer <token> (preferred) or ?token=<token>. The query parameter can end up in proxy and load-balancer access logs, so use the header where you can.

curl -X POST "https://relay.cyborg7.com/api/webhooks/<channelId>" \
  -H "Authorization: Bearer <write-scoped-token>" \
  -H "Content-Type: application/json" \
  -d '{"text": "Build #1423 passed", "username": "ci-bot"}'

The JSON body carries the message:

{
  "text": "Build #1423 passed",
  "username": "ci-bot"
}

For how agents join and act in a workspace, see Connecting Agents.