# Let your own agents work in Demander, inside the same limits

> Scoped personal API tokens for the REST API and a remote MCP server over Streamable HTTP, with twelve tools that read, propose and approve changes through the same gate as the dashboard.

Everything in the dashboard runs on a REST API, and the same API is offered to AI agents as an MCP server. An agent signs in with a personal API token, sees only the tools its scopes allow, and every change it asks for passes the gate a person’s request would.

## What each token scope allows

Scopes are independent: write does not include read. An agent that should propose but never decide gets read and write, and a person approves in the inbox.

| Scope | REST API | MCP tools |
| --- | --- | --- |
| read | GET routes, plus generating an account brief | Overview, list and explain actions, accounts, account brief, attribution, campaigns |
| write | Other changes, each one through the gate | Set a campaign budget, run optimisation |
| approve | Approve, reject and revert inbox actions | Approve, reject and revert an action |
| admin | Never granted to a token | None |

Workspace settings (autonomy level and guardrails), integrations, members, billing and the tokens themselves always need a signed-in session, so a leaked token cannot switch the gate off.

## Personal API tokens

- **Acts as you.** A token works in one workspace, within your role and the scopes you pick. A viewer’s token cannot write, whatever its scopes.
- **Shown once, stored as a hash.** Create it in Settings under API tokens. The token (dmd_ and 43 characters) is shown once; Demander keeps only its SHA-256 and lists its prefix, scopes, last use and expiry.
- **Expires and dies with your membership.** Expiry is 1 to 365 days, 90 by default, with up to 20 active tokens per person and workspace. Every request re-checks your membership, and a token whose owner left is revoked on the spot.
- **Rate limited.** Each token has its own request budget per minute, on top of the limits per IP address. Revoke a token at any time.

## Connect an agent

```bash
# Claude Code
claude mcp add --transport http demander https://app.demander.to/v1/mcp \
  --header "Authorization: Bearer dmd_…"

# Clients that only speak stdio: bridge with mcp-remote
npx mcp-remote https://app.demander.to/v1/mcp --header "Authorization: Bearer dmd_…"
```

The Messages API MCP connector takes the same URL, with the token as its authorization token. Nothing needs approval on Anthropic’s side.

## The twelve MCP tools

| Tool | What it does | Scope |
| --- | --- | --- |
| demander_get_overview | Spend, clicks, leads, cost per lead, identified sessions, accounts by stage, pipeline, revenue, CAC and ROAS for the last N days, per platform too | read |
| demander_list_actions | The decision inbox, filtered by status | read |
| demander_explain_action | Reason, evidence, expected value, confidence, risk and the gate verdict with its reasons | read |
| demander_list_accounts | Companies with lifecycle stage and fit, intent and engagement scores | read |
| demander_get_account_brief | A short sales brief: summary, why now, talking points and an opener | read |
| demander_get_attribution | Pipeline and revenue by channel, campaign, persona, message or creative under a chosen model | read |
| demander_list_campaigns | Campaigns with daily budget and 30-day spend, clicks and leads | read |
| demander_set_campaign_budget | Proposes a new daily budget through the gate | write |
| demander_run_optimization | Runs creative bandits, budget allocation, persona re-weighting and health checks now | write |
| demander_approve_action | Approves and executes; the hard limits are checked again first | approve |
| demander_reject_action | Rejects, with an optional note kept in the audit log | approve |
| demander_revert_action | Applies an executed action’s stored revert | approve |

## The remote endpoint

POST /v1/mcp speaks MCP 2025-11-25 over Streamable HTTP, the newest revision the official TypeScript SDK implements, in stateless mode with JSON responses. No session id is issued, and GET and DELETE answer 405. The token fixes the workspace, and tools outside its scopes are never offered.

Tool calls run in-process against the same REST routes the dashboard uses, with the same bearer token. Authentication, scopes, membership and role, the gate, rate limits and the audit log are therefore identical to a dashboard request. A request that carries an Origin header must come from an allowed origin, which protects against DNS rebinding; server-side clients send none.

The REST API itself has about 150 endpoints under /v1, from products, personas and creatives to campaigns, audiences, sequences, conversions and analytics. A local stdio MCP server is available too and calls the API with the same token.

## An agent has exactly the authority of the gate

Writes create or decide proposed actions. A budget change from an agent may run at once, wait for approval (a move above the 20 percent daily change limit, for example) or be blocked by a cap, the kill switch or broken tracking, and the tool result says which, with the reasons. At autonomy level 1 an agent still waits for a person. See [guardrails](https://demander.to/features/guardrails/).

Every agent change lands in the audit log under the token’s owner, with a snapshot and a revert. If an agent made a run of changes you do not want, undo everything it did in the last hours in one step.

> **Not available yet.** claude.ai custom connectors sign in with OAuth, which the endpoint does not offer yet. Connect from Claude Code, the Messages API or any client that can send a bearer token.

## Questions

**Can an agent change my guardrails or autonomy level?**

No. Settings, integrations, members and tokens need the admin scope, which no token can hold. They change only from a signed-in session in the dashboard.

**What happens if a token leaks?**

Revoke it in Settings and it stops working at once. Until then it can do only what its scopes and your role allow, every change still passes the gate, and it expires on the date you set.

**Can I let an agent propose changes but never approve them?**

Yes. Give its token read and write only. Its proposals land in the inbox like any other, and a person with approval rights decides.

**Do I need approval from Anthropic to connect Claude?**

No. Create a token, add the endpoint to Claude Code or pass it to the Messages API MCP connector, and the agent can start.

## Related

- [Guardrails and autonomy](https://demander.to/features/guardrails/)
- [Security and data](https://demander.to/security/)
- [Budget and bidding](https://demander.to/features/budget-optimisation/)
- [Attribution](https://demander.to/features/attribution/)
- [How it works](https://demander.to/how-it-works/)

---
Source: https://demander.to/features/api-and-mcp/ · Demander · reviewed 2026-10-02