What each token scope allows
Scopes are independent: write does not include read. An agent that should propose but never decide gets read and write, and a person approves in the inbox.
| Scope | REST API | MCP tools |
|---|---|---|
| read | GET routes, plus generating an account brief | Overview, list and explain actions, accounts, account brief, attribution, campaigns |
| write | Other changes, each one through the gate | Set a campaign budget, run optimisation |
| approve | Approve, reject and revert inbox actions | Approve, reject and revert an action |
| admin | Never granted to a token | None |
Workspace settings (autonomy level and guardrails), integrations, members, billing and the tokens themselves always need a signed-in session, so a leaked token cannot switch the gate off.
Personal API tokens
-
01
Acts as you
A token works in one workspace, within your role and the scopes you pick. A viewer’s token cannot write, whatever its scopes.
-
02
Shown once, stored as a hash
Create it in Settings under API tokens. The token (dmd_ and 43 characters) is shown once; Demander keeps only its SHA-256 and lists its prefix, scopes, last use and expiry.
-
03
Expires and dies with your membership
Expiry is 1 to 365 days, 90 by default, with up to 20 active tokens per person and workspace. Every request re-checks your membership, and a token whose owner left is revoked on the spot.
-
04
Rate limited
Each token has its own request budget per minute, on top of the limits per IP address. Revoke a token at any time.
Connect an agent
# Claude Code
claude mcp add --transport http demander https://app.demander.to/v1/mcp \
--header "Authorization: Bearer dmd_…"
# Clients that only speak stdio: bridge with mcp-remote
npx mcp-remote https://app.demander.to/v1/mcp --header "Authorization: Bearer dmd_…"The Messages API MCP connector takes the same URL, with the token as its authorization token. Nothing needs approval on Anthropic’s side.
The twelve MCP tools
| Tool | What it does | Scope |
|---|---|---|
| demander_get_overview | Spend, clicks, leads, cost per lead, identified sessions, accounts by stage, pipeline, revenue, CAC and ROAS for the last N days, per platform too | read |
| demander_list_actions | The decision inbox, filtered by status | read |
| demander_explain_action | Reason, evidence, expected value, confidence, risk and the gate verdict with its reasons | read |
| demander_list_accounts | Companies with lifecycle stage and fit, intent and engagement scores | read |
| demander_get_account_brief | A short sales brief: summary, why now, talking points and an opener | read |
| demander_get_attribution | Pipeline and revenue by channel, campaign, persona, message or creative under a chosen model | read |
| demander_list_campaigns | Campaigns with daily budget and 30-day spend, clicks and leads | read |
| demander_set_campaign_budget | Proposes a new daily budget through the gate | write |
| demander_run_optimization | Runs creative bandits, budget allocation, persona re-weighting and health checks now | write |
| demander_approve_action | Approves and executes; the hard limits are checked again first | approve |
| demander_reject_action | Rejects, with an optional note kept in the audit log | approve |
| demander_revert_action | Applies an executed action’s stored revert | approve |
The remote endpoint
POST /v1/mcp speaks MCP 2025-11-25 over Streamable HTTP, the newest revision the official TypeScript SDK implements, in stateless mode with JSON responses. No session id is issued, and GET and DELETE answer 405. The token fixes the workspace, and tools outside its scopes are never offered.
Tool calls run in-process against the same REST routes the dashboard uses, with the same bearer token. Authentication, scopes, membership and role, the gate, rate limits and the audit log are therefore identical to a dashboard request. A request that carries an Origin header must come from an allowed origin, which protects against DNS rebinding; server-side clients send none.
The REST API itself has about 150 endpoints under /v1, from products, personas and creatives to campaigns, audiences, sequences, conversions and analytics. A local stdio MCP server is available too and calls the API with the same token.
An agent has exactly the authority of the gate
Writes create or decide proposed actions. A budget change from an agent may run at once, wait for approval (a move above the 20 percent daily change limit, for example) or be blocked by a cap, the kill switch or broken tracking, and the tool result says which, with the reasons. At autonomy level 1 an agent still waits for a person. See guardrails.
Every agent change lands in the audit log under the token’s owner, with a snapshot and a revert. If an agent made a run of changes you do not want, undo everything it did in the last hours in one step.
Questions people ask
Can an agent change my guardrails or autonomy level?
No. Settings, integrations, members and tokens need the admin scope, which no token can hold. They change only from a signed-in session in the dashboard.
What happens if a token leaks?
Revoke it in Settings and it stops working at once. Until then it can do only what its scopes and your role allow, every change still passes the gate, and it expires on the date you set.
Can I let an agent propose changes but never approve them?
Yes. Give its token read and write only. Its proposals land in the inbox like any other, and a person with approval rights decides.
Do I need approval from Anthropic to connect Claude?
No. Create a token, add the endpoint to Claude Code or pass it to the Messages API MCP connector, and the agent can start.