Agents · account access

GrowthCat MCP

Manage GrowthCat through an agent using the same permissions and management APIs as the dashboard. Your personal API key belongs to your user account and can access the apps where you have a membership.

Connect a client

Open Account → Developer API keys. Create a named key with an optional expiration. Choose read-only to inspect data; enable changes for management workflows.
Copy the key or MCP configuration while it is displayed. The full key is shown once. Keep it in your client’s secret settings.
Configure a remote HTTP MCP server at your backend’s /mcp endpoint with Authorization: Bearer YOUR_GROWTHCAT_USER_API_KEY. Use the backend host, not the dashboard or an app SDK key.
Connect the client and ask it to discover GrowthCat operations before making changes. Revoke a key in Account to end its access.

{
  "mcpServers": {
    "growthcat": {
      "url": "https://your_growthcat_api_host/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_GROWTHCAT_USER_API_KEY"
      }
    }
  }
}

Replace the host and key placeholders. Client configuration formats vary; clients that support remote MCP URLs and authorization headers can use this example.

Discover, inspect, then execute

Tool	Purpose
growthcat_discover_operations	Find operations by search or group; use cursor and limit for pagination.
growthcat_describe_operation	Read a discovered operation’s parameter and body schemas.
growthcat_read	Execute a read operation with operation_id, path_parameters, query, and workspace.
growthcat_write	Execute a write operation with the same parameters plus body and, when required, confirm: true.

Agents use operation IDs from the live catalog; they cannot request arbitrary URLs. Resources growthcat://operations and growthcat://workflows provide schemas and workflow guidance. Writes require a key with read and write scopes plus the user’s existing resource permissions.

Example agent workflows

“List my apps, then describe the operations needed to configure a new app and its RevenueCat connection.”
“Create a draft friend program in sandbox. At 5 qualifying friends give one month; at 10 give twelve months. Keep rewards manual until I review the configuration.”
“Inspect campaigns, influencers, offers and analytics, then propose changes for my app.”
“Configure feedback categories, sponsorship settings or ad placements using the discovered schemas.”

The catalog includes account and app management operations for apps, campaigns, referrals, offerings, influencers, sponsorships, ads, feedback, acquisition, analytics, settings, billing, marketplace and invitations. Setup steps are normal management operations discovered by their group or description.

Plan capacity and acquisition workflows

Discover billing usage and plans before creating or activating friend programs or acquisition campaigns. REST, dashboard, and MCP use the same app-owner allowance; your key holder's own plan does not replace the target owner's quota. Tool calls are not a commercial meter. Public link-event traffic thresholds are advisory and do not block campaign activation; active-campaign capacity and signed acquisition attribution thresholds can block additional activations.

If an operation returns plan_limit_reached, preserve the draft, explain the meter and allowance, and direct the owner to upgrade. No automatic overage charges apply. Existing attribution, accepted referrals, earned rewards, and fulfillment continue.

Example: “Inspect my usage, create a draft Website acquisition campaign with source TikTok, and tell me which web SDK arrival integration is needed before activation.” A source label identifies tracking traffic; it does not connect native ad-platform reporting.

Current plan limits and counting rules

Workspaces and sensitive actions

App operations default to sandbox. Pass workspace: "live" explicitly for production changes. Sandbox is not a universal dry run: billing, profile and provider actions can have account-wide or external effects. Operations that delete, reset, send, pay out, issue Apple offer codes, change credentials, decide rewards, verify participant eligibility or import offer-code inventory require explicit confirm: true. Eligibility verification and inventory imports can release held benefits. Read each operation description before executing it.

Admin, SDK, webhook, public, password/security and personal-key-management endpoints are excluded. Secret response fields are redacted. Authorized asset-upload operations return a short-lived upload URL so agents can upload media and then create creatives. Provider secrets remain private. Create and revoke personal keys through your signed-in account settings.