Guides
Changelog
Back to All
Added

Remote MCP Server for the Alvys Public API

about 2 months ago

Release Date: June 3, 2026 (server), June 18, 2026 (prompts & write tools), July 3, 2026 (user sign-in)

What's New?

Alvys now ships a remote Model Context Protocol (MCP) server that exposes the Public API to AI agents — Claude, Cursor, and your own custom agents. Instead of hand-wiring HTTP calls, an agent connects to one governed endpoint and discovers Alvys tools automatically.

What Changed?

Previously, integrating an AI agent with Alvys meant holding a raw Public API token and calling REST endpoints directly.

Now, agents connect to the Alvys MCP server and get:

  • Read tools across core entities — loads, trips, carriers, customers, drivers, trucks, trailers, invoices, deductions, fuel transactions, tenders, visibility history, and documents.
  • Write tools (opt-in) — create/accept/reject tenders, record carrier and customer payments, record financing, assign and dispatch trips, update carrier status, upload documents, record stop arrivals/departures, and update stop appointments.
  • Curated prompts (v1) — guided multi-step workflows such as find_and_cover_load, dispatch_driver, carrier_onboarding, settlement_reconciliation, and track_shipment.

Authentication

Two ways to connect:

  • Machine-to-machine — Auth0 client-credentials tokens, same as the Public API.
  • User sign-in — OAuth 2.1 with PKCE per the MCP specification, including protected-resource discovery (RFC 9728) and resource indicators (RFC 8707), so interactive clients like Claude can sign in as a user.

Governance & Safety

  • Tenant isolation is enforced from the token — never from the request body.
  • Every tool is classified Read / Write / Destructive with runtime gates; write tools are disabled unless explicitly enabled.
  • Each tool requires a matching granular API permission (e.g. tender:read, invoice:update).
  • All calls are rate-limited, size-capped, and audit-logged.

Why?

AI agents are becoming a first-class way to operate a TMS. The MCP server gives them a discoverable, audited, tenant-isolated surface — one choke point with tool-level authorization instead of raw API tokens spread across agents.