Use the same HTML report renderer as the Work view inside iMothership. Access remains limited to the credential’s project and Run as user. An authorized link opens the report, not the surrounding application navigation.
GET /api/v1/works to discover work IDs and has_view.GET /api/v1/works/{id} for metadata and its normal login-protected app_url.POST /api/v1/works/{id}/view.view_url in a browser to render the report. A browser-enabled agent can inspect the page, change filters and use supported controls. MCP itself does not render pages or turn the link into report data.POST /api/v1/works/WORK_ID/view
Authorization: Bearer YOUR_MCP_ACCESS_TOKEN
Content-Type: application/json
{"interactive":true,"expires_in":86400,"filters":{}}
API keys can use X-Api-Key instead and must have a current project member selected as their Run as user. Do not place the original API key or OAuth token in a URL.
When the user requests a link, include the complete returned view_url as a clickable Markdown link [Open report](RETURNED_VIEW_URL) in the same reply, without backticks or code fences. Preserve the entire URL including its token; never invent or truncate it. Give expires_at separately. Sharing privately with the requesting user is intended; do not publish publicly or log the URL. Do not merely announce that the link is ready.
Filters become URL query parameters. Names and formats vary by report; use only the report’s documented parameters. The API does not infer filter names from HTML. You can also use the report’s visible controls.
By default, links load report files and live MongoDB data using mcp:read. interactive:true enables data loading and filtering; it does not grant write permission. Set interactive:false only when files-only access is wanted.
The read-only runtime permits approved MongoDB find, findOne, countDocuments and aggregation queries, including scoped lookups. It blocks database writes, network access, filesystem access, email, imports and executable command tags. Reports using SQLite, external services or other unsupported capabilities require a dedicated read adapter; they fail closed rather than silently gaining write access. Explicit allow_changes:true requires mcp:write and editor/admin permission.
Links last 24 hours by default, with a maximum of 24 hours. Set expires_in to 60-86400 seconds for a shorter lifetime. Existing links retain their original expiration. Anyone holding the link can use its permitted access while it remains valid. Keep it private and avoid publishing or logging it. Relative assets use the existing private renderer protocol.
Links may stop working earlier if the parent authorization expires or is revoked. Every request rechecks the parent authorization and account/project membership. Revoking an MCP connection, disabling an API key, recovering the user’s password, removing project access or unlinking the work stops the link. Expiration does not erase data already displayed or downloaded, and cannot undo an action already executed.
Refresh tool discovery to obtain listWorks, getWork and createWorkViewLink. Use {"path":{"id":"WORK_ID"},"body":{"interactive":true}} for a private interactive link. Tools return JSON. Use a browser tool to view it, or project API tools to retrieve structured report data.