MCP server

The IoT Pulse MCP server exposes your tenant’s fleet to any Model Context Protocol client — Claude Desktop, Cursor, or an agent you build — as a set of read/write tools and a few packaged workflow prompts. It is the second front-end of the Developer Integration Platform, alongside the CLI and the Skills pack.

Like them, it is a thin wrapper over the public API: no business logic and no new endpoints. Your tenant and scopes are resolved server-side from your API key — you never pass a tenant id, and a key can only ever touch its own tenant’s data.

Connect

The server speaks MCP over streamable HTTP at the /mcp path of your IoT Pulse MCP server URL (your administrator provides the base URL; for local development it defaults to http://localhost:3005/mcp).

Authenticate with the same scoped API key you use for the public API and CLI. Send it on every request as either header:

X-API-Key: iotp_your_key_here, or
Authorization: Bearer iotp_your_key_here.

A request with no key is rejected with 401 missing_api_key.

Most MCP clients are configured with a small JSON entry. For example:

{
  "mcpServers": {
    "iotpulse": {
      "url": "https://<your-iotpulse-mcp-host>/mcp",
      "headers": { "X-API-Key": "iotp_your_key_here" }
    }
  }
}

Mint a key in the admin app under Settings → API Keys (the secret, format iotp_…, is shown once at creation).

Tools

Every tool maps to a public API operation and requires the matching scope on your key.

Read tools

Tool	What it does
`list_devices`	List the devices in your fleet.
`get_device`	Fetch one device by id.
`list_device_groups`	List device groups (with alert config and shifts).
`list_thresholds`	List your reusable threshold packs.
`list_shifts`	List shift definitions.
`get_anomalies`	Query anomaly events (filter by device and status; paginated).
`list_provisioning_claims`	List gateway enrollment claims (never the claim code).
`get_provisioning_claim`	Fetch one enrollment claim by id (never the claim code).
`list_device_certificates`	List device certificates, metadata only (filter by device and status; paginated).
`get_device_certificate_audit`	Read the certificate audit trail: who issued, enrolled, renewed or revoked what, and when.

Write tools

Tool	What it does
`configure_device`	Update a device’s configuration (name, category, criticality, analysis interval, tags, location…).
`acknowledge_anomaly`	Mark an anomaly event as handled.
`update_ticket`	Update a maintenance ticket (status, severity, assignment, notes…).
`create_ticket`	Open a maintenance ticket for a device.
`set_threshold`	Create a reusable threshold pack.
`create_device_group`	Create a notification group.
`assign_shift`	Assign an existing shift to a group.
`create_provisioning_claim`	Mint a gateway enrollment claim. The claim code comes back only this once.
`revoke_provisioning_claim`	Revoke an enrollment claim.
`revoke_device_certificate`	Revoke a device certificate so the broker refuses it.

There is deliberately no tool that issues a device certificate. A new certificate comes with its private key, and a private key should not end up in a model transcript. Issue certificates with iotpulse certs issue or the admin app.

Give the MCP server’s key device-certificates:read, plus device-certificates:revoke if you need revoke_device_certificate. Never give it device-certificates:issue: that scope lets the key issue certificates, private keys included, through the raw API, and MCP client configs often store the key in plaintext.

Workflow prompts

The server also exposes three packaged, multi-step workflows as MCP prompts. Any MCP client lists them with the standard prompts/list call and fetches one with prompts/get; the prompt expands into instructions that drive the tools above.

Prompt	Arguments
`onboard_device_fleet`	`groupId` (optional), `namePrefix` (optional)
`tune_thresholds_for_process_type`	`processType` (required)
`triage_anomalies_to_tickets`	`deviceId` (optional), `status` (default `open`)

The same three workflows also ship as portable Agent Skills that drive the CLI — see Skills.

Errors and limits

Because tools call the public API, they surface the same structured errors and limits: 401 invalid_api_key, 403 insufficient_scope when your key lacks a scope, 404 not_found, and per-key rate limiting (429). See the public API reference for the full table.