> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stackshift.cloud/llms.txt
> Use this file to discover all available pages before exploring further.

# Stackie asset tools and MCP

> Use the same governed asset actions from Stackie, workflow Stackie nodes, and stateless Streamable HTTP MCP clients.

<Tip>
  **Live.** This area is documented as current, user-reliable behavior.
</Tip>

## Goal

Give agents useful asset capabilities without granting arbitrary code, secret access, destructive tools, or unbounded side effects.

## Prerequisites

* A PAT carrying only the asset scopes the client needs
* An MCP client that supports stateless Streamable HTTP

## Workflow

<Steps>
  <Step>
    Read `/api/v1/assets/automation` to discover registered tools, scopes, risks, and recent audited calls.
  </Step>

  <Step>
    Configure the MCP server URL as `/api/v1/assets/mcp` and authenticate with the PAT as a Bearer token.
  </Step>

  <Step>
    For a workflow Stackie node, set an objective, output JSON schema, tool allowlist, and explicit token/time/tool/cost budgets.
  </Step>

  <Step>
    Treat returned text and media-derived content as untrusted data; consume only schema-validated output.
  </Step>
</Steps>

## Tool and scope matrix

* `search_assets`, `get_asset`, and `get_asset_operation`: `assets:read`.
* `organize_assets`: `assets:write`.
* `transform_asset`, `moderate_asset`, and `transcribe_asset`: `assets:process`.
* `generate_asset`: `assets:generate`; generated images start private and remain gated through storage, replication, scan, moderation, provenance, and spend reconciliation.
* The MCP endpoint accepts any PAT with a concrete Assets scope, but every individual tool call rechecks its own required scope. `assets:*` is not treated as a wildcard; the platform-wide `*` scope is.

## MCP transport and browser-origin rules

* Transport is stateless Streamable HTTP using the official Go MCP SDK. Requests inherit HTTP cancellation and platform rate limits.
* A non-browser client may omit `Origin`. If supplied, Origin must exactly match the configured StackShift frontend origin or the request origin; userinfo, paths, and unsupported schemes are rejected.
* Inputs, outputs, status, tool name, transport, account principal, and timing are audited after redaction. Prompt bodies and credentials are not exposed by the automation overview.

```json MCP client configuration theme={null}
{
  "mcpServers": {
    "stackshift-assets": {
      "type": "http",
      "url": "https://api.stackshift.cloud/api/v1/assets/mcp",
      "headers": { "Authorization": "Bearer ${STACKSHIFT_ASSETS_PAT}" }
    }
  }
}
```

## Governed Stackie node boundary

* Defaults are at most eight tool calls, one specialist handoff, a two-minute deadline, and no secret access.
* The node cannot add tools beyond its declared allowlist or change execution identity, approval policy, or budgets from prompt content.
* Production, costly, and external nested actions use the workflow version grant only when its fixed constraints cover the resolved call; otherwise the node pauses for a new approval.
* Output must validate against the configured JSON schema before downstream conditions or actions can consume it.

## Expected result

<Check>
  Stackie and MCP execute identical asset-service actions through the central governed registry with account ownership, scope, idempotency, approval, audit, cancellation, and redaction enforced.
</Check>

## Related guides

<CardGroup cols={2}>
  <Card title="Media Workflows visual builder and API" href="/assets/media-workflows">
    Author editable templates or blank typed DAGs that coordinate asset gates, native StackShift services, bounded Stackie reasoning, and approved external integrations.
  </Card>

  <Card title="Media Workflow authority, integrations, and recovery" href="/assets/media-workflow-security-and-operations">
    Operate workflow grants, execution principals, durable waits, restricted HTTP connections, signed inbound hooks, retries, cancellation, and post-publish warnings.
  </Card>

  <Card title="StackShift AI agents" href="/ai-features/ai-agents">
    Stackie and five direct-entry specialists perform evidence-based work through durable runs, tenant-scoped tools, and approvals bound to the exact action and target.
  </Card>
</CardGroup>