The build MCP

POST /api/build/mcp takes a build key, which starts cc_build_ and is a different thing from a serving key. It opens a whole workspace rather than one tool, which is why only an owner can create one and why it refuses any request carrying an Origin header outright.

Six tools: list_datasets, get_dataset, list_contracts, get_readiness, list_review_items and get_receipts. All read-only, and not by convention. They run inside a read-only database transaction, so a write cannot happen even if something tried.

Record contents are off by default. list_review_items will not return the record itself unless the key was explicitly granted that. An agent can triage a queue by field and reason without ever reading your data.