The default set is read-only plus tables, and everything that writes — or that can archive and delete — sits behind ENABLED_TOOLS. Widening it is one line, and the scopes on your Service Account are the boundary that actually holds.
A server for one Tulip instance that puts the Tulip API in front of an MCP client. It runs from npx against a file holding your instance URL and API credentials.
- Tools grouped by what they touch: tables, machines, users, apps, interfaces, stations and station groups
- Read-only and table tools enabled by default, so a fresh install cannot delete or archive anything
- A tool set you widen yourself with ENABLED_TOOLS — by tool name, by security category, or by resource type
- Access through a Tulip Service Account, so the key carries only the scopes you grant it
Node.js, and a credentials file holding TULIP_API_KEY, TULIP_API_SECRET and TULIP_BASE_URL. TULIP_WORKSPACE_ID applies only to an Account API key — a Workspace API key leaves it blank. MCP clients need the full path to that file passed with --env, because the client will not be running in the directory that holds it.
One command plus a key — npx @tulip/mcp-server, then supply credentials