One server. Two transports. Every agent speaks MCP.
COMPASS exposes its tools as a Model Context Protocol server. The tool reference lives in the documentation at docs.compass.athron.io. The same server, the same tool list, whether an agent runs locally or comes over the network. Underneath is an HTTP API for your own scripts.
For agents on the same machine
Claude Code and Cursor start the server as their own process and talk over stdin and stdout. The key comes from the environment.
For Cowork, Claude apps and any HTTP client
One shared process behind nginx. Every request carries its own key; the server stores none of its own. Without the header it answers 401 before any tool runs.
# Claude Code claude mcp add --transport http --scope user compass \ https://<eure-instanz>/mcp/ \ --header "X-Compass-Key: <key>"
Read and write kept apart
A read key on a write tool gets 401 in plain words, not a 500. The backend checks the role, not the client.
Sign in instead of pasting keys
Connectors discover the OAuth metadata themselves. The browser opens sign-in with your company account; the role sets the scope: admin writes, everyone else reads.
Read, write, propose
gilt, warum, memory_search, aussage_put, frage_stellen. Each tool’s documentation lives in COMPASS itself.
For your own scripts
Under /api/v1/ you find the same resources: topics, statements, memory, processes, personas. Nothing is ever deleted — a new statement supersedes the old one via ersetzt, and the old one keeps its own span of validity.
POST /api/v1/aussagen
X-Compass-Key: <write key>
{ "sache": "delivery",
"art": "entscheidung",
"text": "Delivery by 6 pm.",
"herkunft": "entschieden",
"ersetzt": 561 }If a server signing key is missing, the OAuth routes answer 503 with the cause. The X-Compass-Key path is unaffected.