AI agents and MCP
Let an AI agent work on your site, under rules you set.
Hatamoto speaks MCP, so an agent can read your content and reports, draft pages and publish them, with a key that can do only what you tick.
{
"mcpServers": {
"hatamoto": {
"url": "https://example.com/mcp",
"headers": { "Authorization": "Bearer <your-key>" }
}
}
}Giving an agent your admin login is a bad deal.
An agent with a password can do everything you can, with no record and no limit. A scoped key lets it help while you stay in charge of what goes live.
What you get
-
Keys with limited scopes
Read entities, read reports, read SEO or write entities. A key never does more than the account that made it, and it can expire.
Users and API keys -
Drafts first
entities_create and entities_duplicate always make a draft. A person decides when anything goes public.
-
Build pages, not just text
An agent can edit a page's layout with builder_apply_ops and check it with builder_validate.
-
Check its own work
jsonld_validate and seo_preview let the agent test structured data and the public head before publishing.
-
Every call is logged
Allowed and refused calls are written to an audit log with the key, the tool and shortened arguments, and old rows are pruned after 90 days.
-
Read the AI reports
With the reports scope an agent can answer which crawlers fetched your site this month, from live data.
Under the hood
-
Streamable HTTP at /mcp
Built on the official Go SDK, with the key sent as a Bearer token.
-
Keys start with nxk_
Shown once at creation. Only owners can create them.
-
Tools follow scopes
A tool outside the key's scopes is refused and logged.
Questions people ask
Which agents work?
Any tool that supports MCP servers. Add the site's /mcp address and a key in the tool's MCP settings.
Can an agent publish without me?
Only if you give its key the write scope. Without it the agent can read, and with it the agent can publish, so grant it on purpose.
Connect your first agent
Install Hatamoto, create a key and add the server to your AI tool.