# Network MCP

> Connect remote agents through Streamable HTTP and OAuth.

Connect a remote MCP client to the studio. Network tools work on persisted projects using your API key or an OAuth access token; they do not require an open editor tab.

Streamable HTTP endpoint `https://studio.datxanhmientrung.ai/mcp`Authenticated · POST

## Connect with an API key

In your client's remote-server configuration, choose HTTP/Streamable HTTP, enter the endpoint above, and configure `Authorization: Bearer` using your secure token input. Client configuration-file formats and environment interpolation vary; these are the connection parameters, not a universal import file.

```
URL: https://studio.datxanhmientrung.ai/mcp
Transport: Streamable HTTP
Authorization: Bearer <securely supplied DESIGN_STUDIO_API_KEY>
Protocol: 2025-11-25
```

```
curl "$DESIGN_STUDIO_URL/mcp" \
  -H "Authorization: Bearer $DESIGN_STUDIO_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "MCP-Protocol-Version: 2025-11-25" \
  --data '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-11-25","capabilities":{},"clientInfo":{"name":"my-design-agent","version":"1.0.0"}}}'
```

Use `get_design_brief` and `update_design_brief` to interview the human with your own agent model. `interview_design_brief` instead invokes the owner's configured BYOK provider. `approve_design_brief` requires explicit human approval of the current answered scope and its independent brief revision. `inspect_design` reads deterministic preflight findings; it is not a visual-quality certification.

## Inspect real images

Call `inspect_project` with `projectId` and `mode: page` or `overview`, or call `inspect_workspace` for owned-project covers. The results contain PNG image blocks alongside text metadata, saved revisions and `nextOffset`. View the image blocks before judging quality; follow pagination and use page mode for fine details. These private reads render saved state without publishing or provider calls. See the [visual review workflow](https://studio.datxanhmientrung.ai/docs/cli) and live tool schemas for selection, sampling and limits.

## Connect with OAuth

- Use the same remote URL and choose OAuth in a compatible client.
- The client discovers the protected resource and authorization server, registers its redirect URI, and requests the `studio` scope.
- Sign in to the studio and approve consent in the browser. Consent requires your account session.
- The client exchanges the one-use code with S256 PKCE for access/refresh tokens, bound to the canonical `/mcp` resource.

| Method | OAuth path | Purpose |
| --- | --- | --- |
| GET | /.well-known/oauth-protected-resource | Resource and authorization-server discovery |
| GET | /.well-known/oauth-protected-resource/mcp | Path-specific resource discovery |
| GET | /.well-known/oauth-authorization-server | Endpoints, grant types, PKCE, scope |
| POST | /oauth/register | JSON client_name and redirect_uris; returns client_id |
| GET / POST | /oauth/authorize | Browser consent; exact redirect, state, S256 challenge, resource |
| POST | /oauth/token | Form-encoded authorization_code or refresh_token grant |
| POST | /oauth/revoke | Form-encoded token and client_id; revokes its token family |

Use HTTPS redirects or HTTP loopback for local clients. Resource must equal the canonical MCP endpoint. Access tokens last one hour; refresh tokens rotate. OAuth tokens cannot create/manage permanent API keys or provider credentials. GET event streams and protocol sessions are not used; supported versions are 2025-11-25 and the SDK's 2025-06-18/2025-03-26 compatibility. The newer 2026 transport is not advertised.

## Observe and reconcile human edits

Use `get_design_changes` to observe saved revisions. Keep the exact document and revision you read as the base for `merge_design`; independent edits can merge, while overlapping changes return conflict paths. Resolve those changes explicitly. Never alter the base or invent a revision to bypass a conflict.

## Discover tools and resources

Call `tools/list` to get the live input schemas. Tool names below are implemented; their descriptions identify reads, writes, publication, and potentially paid provider calls.

### Projects

`list_projects``inspect_project``inspect_workspace``get_project_thumbnail``get_project``create_project``update_document``patch_document``delete_project`

### Collaboration

`get_design_changes``merge_design`

### Brief and scope

`get_design_brief``update_design_brief``interview_design_brief``approve_design_brief`

### Design resources

`inspect_design``list_themes``list_templates``list_components``apply_theme`

### Design-system libraries

`list_design_systems``get_design_system``list_design_system_versions``create_design_system``update_design_system``apply_design_system``insert_design_system_item``delete_design_system`

### Discovery

`list_google_fonts``list_provider_models`

### Assets and delivery

`upload_asset``list_assets``preview_project``unpreview_project``share_project``unshare_project``publish_project``unpublish_project``export_project`

### Generation

`generate_design``generate_media``get_media_job`

```
curl "$DESIGN_STUDIO_URL/mcp" \
  -H "Authorization: Bearer $DESIGN_STUDIO_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "MCP-Protocol-Version: 2025-11-25" \
  --data '{"jsonrpc":"2.0","id":2,"method":"tools/list","params":{}}'
```

Resources: `studio://schema`, `studio://operations`, and `studio://projects/{projectId}`. Writes such as `update_document`, `patch_document`, and `apply_theme` require `expectedRevision`. Library updates use expectedVersion; apply/insert use the observed project expectedRevision and an optional saved library version. Discovery query matches names/IDs/categories and reports live/cache/fallback provenance; provider model discovery requires an API key rather than MCP OAuth. React ZIP and GLB/glTF are returned as base64 resources by export_project, which also accepts optional expectedRevision. Binary MCP responses are limited to 20 MB; use CLI export for larger files.

[Configure agent access](https://studio.datxanhmientrung.ai/?settings=agents)