Krobot MCP Server

Krobot, Kromatic’s public MCP server — the full innovation-coaching knowledgebase (frameworks, client engagements, methodologies) and the complete text of The Real Startup Book, one call away from any AI agent.

Connect your AI agent to Kromatic’s knowledge base using the Model Context Protocol (MCP). The canonical entry point is agent self-signup — one HTTP call to /agent/public/v1/auth/agent-signup returns an mcp_oat_* access token (30d) plus an mcp_ort_* refresh token (90d). No browser, no OAuth dance. Then call the Streamable HTTP transport at https://api.kromatic.com/mcp/public/.

What is Krobot MCP?

Krobot MCP is Kromatic’s public Model Context Protocol server. It exposes Kromatic’s knowledge base—blog posts, innovation tools, program guides, and more—as structured resources that any MCP-compatible AI agent can query. Zero-context agents authenticate via Path 1 (agent self-signup); a Personal Access Token (PAT) path is offered for human-controlled accounts that want to grant a specific agent access.

MCP Endpoint

MCP-native clients connect to the Streamable HTTP transport at:

https://api.kromatic.com/mcp/public/

The trailing slash matters — without it the server returns a 307 redirect that some MCP clients won’t follow.

Available Tools

Authentication — Path 1: Agent self-signup (canonical)

https://api.kromatic.com/mcp/public/ only accepts tokens with the mcp_oat_* (Path 1 access token) or mcp_pat_* (Path 2 PAT) prefix. The legacy 24h login JWT from /auth/login is not accepted at the MCP transport — calling it with such a token returns 401 bearer_token_invalid.

Path 1 is the canonical entry point for any zero-context agent: a single POST with an agent-controlled email and an explicit newsletter opt-in returns an mcp_oat_* access token (30d) plus an mcp_ort_* refresh token (90d) in the response body.

POST https://api.kromatic.com/agent/public/v1/auth/agent-signup

Request:

curl -X POST https://api.kromatic.com/agent/public/v1/auth/agent-signup \
  -H "Content-Type: application/json" \
  -d '{
    "email": "[email protected]",
    "subscribe_to_news": false,
    "client_name": "my-agent"
  }'

Response (201):

{
  "access_token": "mcp_oat_<hex>",
  "refresh_token": "mcp_ort_<hex>",
  "token_type": "Bearer",
  "expires_in": 2592000,
  "refresh_expires_in": 7776000,
  "account_created": true,
  "email": "[email protected]"
}

Pass the access token as Authorization: Bearer mcp_oat_<hex> to https://api.kromatic.com/mcp/public/. 409 means the email belongs to a real-password (human) account — use Path 2 below or pick a different email. 429 means a per-IP or per-email rate limit; back off and retry.

Take-over flow (Path 1 only)

If an agent self-signed up against [email protected], the human Alice can claim the account at any time: visit kromatic.com and run Forgot passwordon that email, or sign in via OAuth on the same email (either path links to the existing row). The agent’s previously issued mcp_oat_* token keeps working until revoked or expired; Alice is the human owner from then on.

Connecting from AI Clients

Claude Code (Path 1 — agent self-signup, canonical)

Sign up, then install with the access token. Place --header after the positional URL — argparse-greedy.

# 1. Self-signup
curl -X POST https://api.kromatic.com/agent/public/v1/auth/agent-signup \
  -H "Content-Type: application/json" \
  -d '{"email":"[email protected]","subscribe_to_news":false}'
# → response includes access_token: mcp_oat_<hex>

# 2. Install
claude mcp add krobot --transport http https://api.kromatic.com/mcp/public/ \
  --header "Authorization: Bearer mcp_oat_<hex>"

Claude Code (Path 2 — PAT, alternate)

Use this when a human already controls a Kromatic account and wants to grant a specific agent access (CI runners, headless workers, or simply a human-curated grant). PAT mint requires a short-lived login JWT first:

# 1. Login with kromatic.com credentials → short-lived JWT
curl -X POST https://api.kromatic.com/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email": "[email protected]", "password": "..."}'

# 2. Mint a PAT (response includes plaintext_token shaped mcp_pat_<32 hex>;
#    shown exactly once — the server only stores the hash)
curl -X POST https://api.kromatic.com/auth/api-keys \
  -H "Authorization: Bearer <login-jwt>" \
  -H "Content-Type: application/json" \
  -d '{"name": "my-laptop"}'

Install with the PAT:

claude mcp add krobot --transport http https://api.kromatic.com/mcp/public/ \
  --header "Authorization: Bearer mcp_pat_<hex>"

Revoke a PAT from the “API access” section of your user profile or DELETE https://api.kromatic.com/auth/api-keys/{id}. Revocation takes effect on the next request.

Other MCP clients

Any MCP client that can pass an Authorization header works: self-sign up via Path 1 (or accept a PAT from a human via Path 2) and target https://api.kromatic.com/mcp/public/.

Example: Semantic Search

{
  "tool": "knowledge_retrieve",
  "arguments": {
    "query": "lean startup experimentation frameworks",
    "limit": 5
  }
}

Token Lifetime & Recovery

• Path 1 (mcp_oat_*): 30-day access token plus a 90-day mcp_ort_* refresh token. To recover from a lost token, call the agent-signup endpoint again with the same email — the response includes a fresh pair (with account_created: false).
• Path 2 (mcp_pat_*): never expires on its own — valid until you (or an admin) revoke it. Treat PATs like passwords.

Rate Limits & Fair Use

The public MCP tier allows up to 60 requests per minute per token. Agent-signup itself is rate-limited per email and per IP; back off on 429. For higher-volume integrations, contact our contact form.

Questions? Reach out via our contact form.