Versioned REST API
Predictable HTTPS resources, JSON requests, pagination and explicit compatibility rules.
Developer API and MCP Server
Connect applications and AI agents—without bypassing control.
Use a versioned API for application workflows and a permission-aware MCP server for compatible AI clients, with scoped access, asynchronous jobs, signed events, usage limits and complete audit context.
Later-stage planned module. No public production endpoint, API key, MCP connection or paid data access is offered from this page.
Developer platform previewIllustrative contract
Developer overview
One controlled integration layer for applications and agents.
Illustrative resources and workflows. Production contracts will be published only after the platform is ready.
v1planned stable namespace
API styleREST/JSON
Long workAsync jobs
EventsSigned
Agent accessMCP
POST /v1/scans
Authorization: Bearer ••••••••
Idempotency-Key: 3f1a…9c2
{
"project_id": "prj_health_meter",
"url": "https://example.com/",
"modules": ["website_health"]
}
{
"job_id": "job_8f31",
"status": "queued",
"status_url": "/v1/jobs/job_8f31",
"request_id": "req_4bd2"
}
# Poll status or receive an authorised webhook.
REST and JSONVersioned contracts
Async JobsScans and reports
WebhooksSigned event delivery
Scoped AccessKeys and OAuth
Usage ControlsQuotas and limits
MCP ServerTools, resources, prompts
Eight developer-platform capabilities
Build a stable contract before exposing expensive intelligence.
The public page describes the integration direction. Production endpoints, credentials, prices and entitlement rules remain inside the protected developer workspace when released.
OpenAPI Documentation
A machine-readable contract supporting reference pages, validation, testing and future SDK generation.
Scoped Authentication
Server credentials and delegated OAuth access restricted by project, operation and entitlement.
Asynchronous Jobs
Queue long scans, monitoring work and reports without holding one fragile request open.
Signed Webhooks
Deliver approved job, report and alert events with signatures, delivery IDs and retry history.
Usage and Reliability
Rate limits, quotas, idempotent retries, timeouts and provider-cost controls by operation.
Errors, Versions and Logs
Machine-readable problem details, request IDs, audit events and visible deprecation notices.
MCP Integration
Expose selected tools, resources and prompts to compatible AI clients without unrestricted database access.
Integration architecture
Keep transport, entitlement and provider cost separate.
A successful request still needs permission, project access, module availability and enough usage entitlement before work begins.
- 01IdentityWhich application, user or MCP client is making the request?
- 02AuthorisationWhich scopes, project memberships and operation types are permitted?
- 03EntitlementIs the module enabled and is provider-backed usage available?
- 04ExecutionRun locally, enqueue a job or call an approved external provider.
Request decision pathIllustrative preview
CredentialValid and scopedAudience and expiry checked
ProjectMembership confirmedTenant boundary enforced
ModuleEntitled operationUsage category identified
ExecutionJob or direct readRequest ID and audit event
Transport success does not override permissions, provider restrictions, account plan or project ownership.
Application workflow
Authorise, request, observe and retrieve.
Create an integration
Choose an environment, owner, permitted projects, scopes and event endpoints.
Send a valid request
Use HTTPS, a supported version, a protected credential and a unique retry key where required.
Observe execution
Read a direct response, poll an asynchronous job or receive a signed event.
Store the result safely
Use request IDs, result versions, audit logs and your own access controls.
MCP server model
Give agents useful capabilities—not unlimited platform access.
The planned MCP server will map selected Nuvyqo functions into explicit primitives, with stable schemas, clear side effects and human-visible controls.
Tools
Executable functions such as reading a project summary, requesting an entitled analysis or creating a report job.
Resources
Read-only contextual data such as report summaries, issue taxonomies, project metadata or approved findings.
Prompts
User-selected templates for website reviews, launch checks, competitor briefs and reporting workflows.
Human Control
Confirmation and visibility for expensive, external-delivery, write, deletion or sensitive operations.
Nuvyqo Integration Security
Authorised tool-call evidence
Client → identity → scope → tool → result → audit event
READ ONLY
Project summary requested with matching resource scopeAudience, tenant membership, tool input and request ID validated.
CONFIRM
Report delivery sends data outside the projectClient should display recipient, scope, cost and confirmation before invocation.
DENIED
Credential lacks the required provider-data entitlementReturn a structured error without leaking another tenant's resources or usage.
Security and auditability
Every call should explain who did what.
The developer platform should preserve enough context to investigate misuse, retry safely and distinguish user action from model-controlled execution.
- Credential owner, client and environment
- Project, scopes and entitlement decision
- Request, tool and idempotency identifiers
- Input validation and result classification
- Usage charge, latency and final outcome
API and MCP serve different clients
One platform contract, two integration surfaces.
| Question | Versioned API | MCP Server |
|---|---|---|
| Primary consumer | Application code, backend services, automation and dashboards. | Compatible AI hosts, assistants and agent workflows. |
| Interaction model | Explicit HTTP resources and operations chosen by developer code. | Tools, resources and prompts discovered through MCP capabilities. |
| Contract | OpenAPI, HTTP status, JSON schemas, pagination and version rules. | MCP protocol schemas, JSON-RPC messages and declared server capabilities. |
| Authorisation | Scoped credentials or delegated OAuth access. | OAuth for protected remote HTTP servers; host-managed credentials for local stdio. |
| Sensitive action | The application implements its own approval and business flow. | The client should expose tool use and request confirmation for sensitive operations. |
| Best use | Reliable system integration and repeatable automation. | Natural-language discovery and controlled agent-assisted workflows. |
Clear limitations
What this developer page does not promise.
No live endpoint yet
Illustrative paths, tools and payloads are not a production contract or availability claim.
Not every module is universal
Provider-backed rankings, keywords, backlinks and AI data require separate access and usage controls.
MCP is not unrestricted autonomy
Clients and servers still need permission checks, confirmation, validation, timeouts and audit logs.
Versions will change
API and MCP compatibility will be published explicitly, with deprecation notices before breaking changes.
Related modules
Connect integrations to analysis, monitoring and reports.
API and MCP FAQ
Questions before developer access is released.
What is the Nuvyqo API?
The planned Nuvyqo API is a versioned HTTPS interface for authorised applications to create and read website projects, request permitted analyses, inspect job status, retrieve findings and reports, and manage approved integrations.
What is the Nuvyqo MCP server?
The planned MCP server is an agent-facing interface over selected Nuvyqo capabilities. It will expose clearly described tools, resources and prompts so compatible AI clients can discover permitted functions and context without receiving unrestricted platform access.
Is the API or MCP server available now?
Not yet. This page describes the later-stage integration architecture. Credentials, endpoint documentation and connection instructions will be published only after authentication, usage controls, testing, monitoring and support processes are ready.
How will API authentication work?
The roadmap supports scoped API credentials for server-to-server integrations and OAuth-based delegated access for user-authorised applications. Credentials must never be placed in public code, page URLs or browser-visible configuration.
How will MCP authorization work?
A remote HTTP MCP server will follow the supported MCP authorization model, including protected-resource discovery and OAuth-based bearer tokens. Local stdio integrations will use environment or host-managed credentials rather than an HTTP authorization flow.
What can an MCP tool do?
A tool can perform one clearly defined operation, such as reading a project summary, requesting an entitled page analysis or creating a report job. Inputs, outputs, permissions, cost and side effects must be described and validated.
Will AI agents be able to make destructive changes automatically?
No unrestricted destructive access is planned. Write, expensive, external-delivery or deletion actions should require appropriate scopes, explicit tool descriptions, audit logging and user confirmation where the client supports it.
How will long-running scans work?
Long analyses will use asynchronous jobs. A client creates a job, receives an identifier, checks status or receives a signed webhook, and retrieves the completed result when the job reaches a terminal state.
How will rate limits and usage be handled?
Usage will be controlled by plan, endpoint, provider cost and project entitlement. Responses will explain when a limit is reached, when a retry may be attempted and which usage category was affected.
Will the API provide webhooks?
The roadmap includes signed webhook deliveries for selected events such as job completion, report readiness and monitor alerts. Delivery identifiers, retry history and endpoint controls will be visible inside the account.
Will there be SDKs and OpenAPI documentation?
The API will be described with an OpenAPI document and human-readable reference pages. Generated SDKs may follow after the HTTP contract is stable and tested.
Can one API key access every Nuvyqo module?
No. Access should be limited by scopes, project membership, account plan, data-provider entitlement and operation type. A credential should receive only the permissions needed for its integration.
Developer platform roadmap
Prepare the project and permissions first.
Create an account and add the website project. Developer credentials and MCP connection details will be released only after production controls and documentation are ready.