Skip to content
Documentation
On this page

The MCP endpoint

One endpoint gives an agent every app you have configured, without putting a credential in the agent. Codemode, sign-in and elicitation modes explained.

Executor serves one MCP endpoint at /mcp. Every app you have configured is reachable through it. You do not add one MCP server per service, and you do not paste a credential into the agent.

  • Hosted: https://v2.executor.sh/mcp
  • Self-host: <your origin>/mcp
  • Local: http://127.0.0.1:4312/mcp

The transport is streamable HTTP. See Add an MCP client for the exact setup commands.

The tools

The endpoint does not expose one MCP tool per app tool. However many apps you add, the tool list stays the same size.

  • skills reads the instructions an app ships. Call skills({}) for a list of what is visible, skills({ app: "support-inbox" }) for one app’s skills, and skills({ app: "support-inbox", name: "triage" }) to read one. It connects no account and runs no code.
  • execute runs a JavaScript program over your apps.
  • resume continues a program that paused for an approval or for input. It is not present in native mode, where the client answers in place.

Codemode

execute is the way an agent uses your apps. The agent writes a short JavaScript program; Executor runs it in a sandboxed interpreter and returns what the program returns.

Inside the program, app tools are ordinary async functions:

return await tools.search({ query: "vercel projects" });

Search returns the exact callable path and the TypeScript signature for each tool. The paths look like this:

const projects = await tools.vercel.queries.listProjects({});
return projects.projects.map((project) => project.name);

The agent can call several tools, join the results and return only the part it needs. That is the point: the whole result set never has to pass through the model’s context.

The interpreter has no fetch, no process, no filesystem and no imports. Its only way out is a tool call, which enters the trusted runtime where your credentials live. Limits are cooperative, not process isolation. Discovery is not cached across changes, so run tools.search again in a new execute after you add or reconfigure an app.

Some limits are fixed by the server and a client cannot raise them: 65,536 characters of program source, 100 tool calls, 30 seconds, and 65,536 bytes of output.

Signing in from the browser

Hosted and self-host use OAuth. Your client registers itself, opens your browser at /mcp/authorize, and you sign in there. You then choose an organization and approve the connection. The client receives a token; it never receives your password or your accounts.

The grant that comes back is bound to one organization. Switching organization in the dashboard later does not retarget an existing connection, including after the token refreshes. To use a second organization, connect again and approve it separately.

Every request revalidates the token, the approval and your current membership. A revoked grant returns 401. Losing membership returns 403.

The consent screen currently approves every app available to you. Choosing individual apps and tools on that screen is coming later; the server already supports the narrower grant.

Elicitation modes

When a tool needs an approval, or needs input, Executor has to ask you. Where that question appears depends on the mode, which you pick in the endpoint URL and which is then fixed in the grant.

Mode URL Where you answer
model /mcp The agent shows you the request and calls resume with your answer. This is the default.
native /mcp?elicitation_mode=native Your MCP client’s own prompt. The execute call stays open and continues. There is no resume.
browser /mcp?elicitation_mode=browser A signed-in page in your browser. The result carries an approvalUrl; the agent calls resume({ requestId }) to collect your answer.

Native mode needs a client that implements form elicitation. Browser mode is the one to use when you do not want the agent to be the one holding the question.

The mode is part of the grant, not just the URL. Changing the query string on an issued connection does not change the mode.

What is coming later

  • Choosing individual apps and tools on the consent screen.
  • Remembering an approval, so the same action is not asked again.
  • Resuming a program after the server restarts. A lost session cannot be continued, and the program must not be run again automatically, because earlier tool calls may already have taken effect.

Was this page helpful?