Skip to main content
AI Reserve ships a hosted, remote MCP server. Connect it once and the agent you already use can operate your account, not just spend your tokens: who is in the organization, what they may spend, which keys exist, how models route, which GPU machines are running, what is deployed in your AWS account. It acts as you, with exactly the access your role has — a member gets member capability, an enterprise admin gets the whole organization — and never needs the portal to finish an action.
Every operation is in the operation reference: one flat tool per operation, named by what it does (list_org_users, invite_user, quote_gpu_instance), with who may call it and how it runs. The same operations are the admin API over plain HTTP and the aireserve admin CLI, so what an agent can do, a script can do too.

​
Connect with OAuth

No token to mint. The server implements standard MCP OAuth discovery — a 401 points at /.well-known/oauth-protected-resource/mcp, and from there your client finds the authorization, token and dynamic-registration endpoints. PKCE (S256) is required and clients are public. Approving the consent page issues a 30-day management token that never passes through your hands; re-authorizing replaces it, and you can revoke it any time under Management Keys on the portal Keys page.
Then /mcp → aireserve → Authenticate, approve in the browser, and the agent is connected. Tools surface as mcp__aireserve__<operation>; start with mcp__aireserve__whoami.

​
Or mint a token

For a client that cannot run the browser flow (a cloud agent, CI), mint a management token on the portal Keys page under Management Keys: expiring (7, 30, 90 or 365 days), revocable, shown once. Export it and let every config read it from the environment:
.mcp.json (Claude Code) · ~/.cursor/mcp.json uses ${env:AIRESERVE_MCP_TOKEN}
~/.codex/config.toml

​
Permissions

Every time you connect, the consent page lists three permissions, all ticked. Untick any you do not want this tool to have, then approve; the token carries exactly what you ticked and whoami reports it. Permissions only ever narrow. A token can never do more than its owner may do in the portal: what it may do is decided live on every call from the owner’s current role, and a role change or revocation applies on the very next request. A call outside the token’s permissions is refused with insufficient_scope; connect again and tick the permission to allow it. Keys minted on the Keys page pick their permissions the same way. Inference keys (aireserve_api_…) are refused at this endpoint — a leaked inference credential must never gain management powers.

​
What you can do

The tool list is computed per request from your live role and the token’s permissions. With every permission ticked, everyone gets the five fixed tools — whoami, list-models, get-model, get-connection-guide, send-message — plus: Super admins act here as an enterprise admin of the organization their own account belongs to — the same tools, the same scope (that organization, then its teams, then its people), never across tenants and never the platform console; whoami reports enterprise_admin. Four unrecoverable organization-wide actions are portal-only by design and have no tool: hard-deleting a user, purging the organization’s stored content, and removing or reopening a sign-in domain. The agent will point you at the portal for those.

​
How an action runs

Reads and ordinary writes execute on the call and return the outcome:
High-stakes writes — revoking a key, deactivating a member, changing a role, launching a paid GPU machine, deleting a volume — add a confirmation step no client setting can skip. The first call returns the exact consent line (built from the live rows, never from the model’s words) and a signed confirmToken bound to the operation, input and caller. The agent shows you the summary; only after you approve does it call again with the token. Tokens expire in 10 minutes, and execution re-checks the target: if the row changed since you read the line, the call is refused rather than doing something you did not approve.
Secrets — a new API key, an AWS credential — come back in the result once you have confirmed, in secret, flagged sensitive: true. The agent is instructed to hand the value to you verbatim once and never repeat, summarize or store it; treat the transcript accordingly.
The same guards as the portal. Every operation ends in the server action the portal page calls, so its authorization check, audit log entry and invariants run unchanged. The tool list is a courtesy; the guard is the law.

​
Calling the endpoint directly

The endpoint is JSON-RPC 2.0 over HTTPS and single tool calls work statelessly. Send Accept: application/json, text/event-stream; the response is one SSE message event whose data: line is the JSON-RPC response, with the tool’s JSON payload serialized into result.content[0].text.
If you are calling from code rather than an agent, use the admin API instead — the same operations as plain POST /v1/admin/{opId} requests, and the SDKs wrap them.

​
Rate limits and errors

Only tools/call is metered — initialize, ping and tools/list are free protocol chatter. Limits are per organization (the same per-minute and per-day budget as the machine API); over the limit you get 429 with Retry-After. send-message may take a while on a slow model; the endpoint allows 120 seconds per call. Authorization failures carry a readable reason: invalid_token on the HTTP layer for a bad credential, an in-band {"error": …} result for an operation your role cannot perform.