▸ Subscriber service · Streamable HTTP
Subscriber service
Authenticate with one method, point your MCP host at the URL below, and reload. The MCP does not scan your repo — your apps and CI still prove enforcement.
Subscribers point any MCP-capable harness at one Streamable HTTP endpoint — Cursor, Claude Code, Windsurf, claude.ai Connectors. Versioned tools, deterministic routing, no per-team prompt sprawl.
This is the delivery mechanism, not the argument. For what it is delivering and why that matters, read agentic engineering.
Use this exact URL in every client — include the
/mcp path.
AADM https://mcp.aadm.io/mcp Discovery · https://mcp.aadm.io/ · Health · https://mcp.aadm.io/health
Don't paste an aadm_ token and an OAuth Client ID
together — they're different auth paths.
Sign in to AADM
to open the member area and create an API key (ak_…) under API keys.
Not for claude.ai web Connectors — they require OAuth below.
Member API key
Use Bearer + full
ak_… from
Member area → API keys.
Authorization: Bearer <your token here>~/.cursor/mcp.json {
"mcpServers": {
"aadm": {
"type": "http",
"url": "https://mcp.aadm.io/mcp",
"headers": {
"Authorization": "aadm_<your token here>"
}
}
}
} url must be https://mcp.aadm.io/mcp. For ak_ account API keys, use Bearer form:
{
"mcpServers": {
"aadm": {
"type": "http",
"url": "https://mcp.aadm.io/mcp",
"headers": {
"Authorization": "Bearer <your token here>"
}
}
}
}accounts.aadm.io, subscribe if needed, then create an API key in the member area.
Paste into Authorization in mcp.json.
Reload Cursor (or restart MCP) so tools/list refreshes.
Credentials are not shown on this public page. Sign in to AADM
to open the member area and create your ak_… key. Paste it as the Bearer token in Cursor, Windsurf, Codex, or curl.
MCP server URL · https://mcp.aadm.io/mcp
⚠ Do not use an API key here
Give your client only the server URL. It opens accounts.aadm.io; sign in with the same account you subscribed with and click Allow. Leave any Client ID and Client Secret fields empty.
Your client identifies itself to AADM's sign-in service, so there is no client ID to copy. You need an active subscription on the account you sign in with. Per-client steps, and a fallback for clients that still ask for a Client ID, are in the member area .
MCP server URL · https://mcp.aadm.io/mcp
Claude Code
claude mcp add --transport http aadm https://mcp.aadm.io/mcp /mcp and choose Authenticate for aadm. claude.ai Connectors
https://mcp.aadm.io/mcp ▸ Optional · not required to connect
You do not need this to connect the hosted MCP. Use it when you want
.aadm/config.json in an application repo (UDALI paths, lanes, CI
stubs). Tokens stay in your IDE — never commit secrets into the config file.
npx aadm-init-repo --minimal
npx aadm-init-repo --fullSubscribers point hosts at the MCP endpoint and get deterministic access to the standard library — not a chatty wrapper around the public web.
Read AUTH packs, UDALI doctrine, layer guides, and workflow mode docs as versioned MCP resources.
Call tools for briefs, routing, doctrine slices, delivery planning, defect debugging, and assurance programs — each with stable contracts for orchestrators.
Troubleshooter-shaped outputs enforce execution control: atomic next actions, scope guardrails, and classification before “fix” stories run away.
The MCP describes how controls should apply; your services and CI still prove enforcement. No silent claims of pass/fail in consumer repos.
Citation namespaces
Keep audit labels distinct ·
AUTH = must-enforce ·
SEAM = which crossing to prove ·
TRACE = drift pattern ·
VERT/HORI = attestation depth and boundary kind (from
sentinel_closure).
Column-only traces miss dispatch-time ids. Use SEAM-04 / SEAM-05 when aliases are normalized in-process. Public policy · standards/seam-catalog.md .
▸ Outcomes your teams can drive
Navigator-style scope, verify, readiness with plan_delivery and doctrine-backed checks — not a generic checklist.
Investigator path keeps recon evidence-first. Path B diagnosis stays gated until routing accepts proof.
Sentinel surfaces audit programs and seam closure language so “alignment” means traceable evidence, not vibes.
standard_brief, route_lane, and follow-on catalogs give hosts deterministic branching instead of keyword roulette.
Fetch AUTH slices where enforcement belongs in the stack — without dumping entire PDFs into every prompt.
Hosted MCP tracks server capabilities; you integrate once and inherit capability schema bumps on your schedule.
The MCP treats Navigator, Investigator, and Sentinel as peers. Pick the lane that matches the primary question — standard orchestration uses first-match routing so you don't “Navigator away” a defect.
I
Workflow · delivery
Net new or material improvement. Map scope, bind AUTH references, pull doctrine slices, and exit with readiness language your integrators can execute against.
II
Workflow · defect
Broken vs expected. Append evidence, respect halt-before-fix, and only deepen diagnosis when classification crosses the router threshold.
III
Workflow · assurance
Prove existing alignment. Scope seams, bind evidence, run audit-program language, and attest readiness without pretending a single bug ticket is “compliance.”
▸ What it feels like to talk to the MCP
Illustrative panels — wording is shortened; real payloads follow the server's JSON contracts and gates.
You · Feature: OAuth-backed export for enterprise tenants. Need UDALI-shaped scope and AUTH touchpoints.
Host · standard_brief with issue text + repo hints.
MCP · capabilities_schema_version,
navigator_feature_delivery stages,
orchestrator_contract.
Follow-on catalog points to fetch_auth, doctrine slices,
plan_delivery — single next action per recon posture.
You · Playwright times out on checkout; bumped timeout — still flaky.
Host · Second call with append_evidence: last HAR row + test name.
MCP · rootCauseClassificationStatus: UNCLASSIFIED, Path A recon;
testTimeoutInflationRuleActive nudges proof before timeout edits.
Single next action · capture missing network stub vs UI assertion — no multi-file refactor until
CLASSIFIED.
You · Quarterly attest: MCP integration + L7 gateway + CI evidence for AUTH-12.
Host · Scope = MCP host + repo CI; bind
agent_observability_expectations per seam.
MCP · Audit program slice +
sentinel_audit_exit_kind framing; gaps hand off to Investigator
or Navigator per edge-case rules — not mixed in one thread.
Attestation dimensions reference AUTH resources and UDALI layers; hosts keep local evidence IDs.
Subscribers run the hosted MCP service (Streamable HTTP) against your org's credentials. Tokens, rotation, and billing live in the operator app — this page is the story; the portal is the mechanics.
Subscriber checkout
Create an account at accounts.aadm.io, then open Member area for API keys or MCP OAuth.
The MCP speaks over Streamable HTTP:
POST with
Accept: application/json, text/event-stream. Browser GET to
the MCP path without that header often returns 406 — expected.
Liveness
GET /health JSON probe for deploy checks and uptime monitors — not the MCP session itself.
Open endpointDiscovery
GET / Service JSON on the MCP host (e.g. mcp_endpoint) for wiring proxies and clients.
Open discoveryStreamable HTTP
https://mcp.aadm.io/mcp
JSON-RPC POST target — include /mcp and Accept: application/json, text/event-stream.
Integrations
Connect guideBearer token vs OAuth — copy-paste configs for Cursor and Claude.
Jump to setupStandard
Public AADM narrativeFree, versioned standard text — the MCP is governed context on top of this story.
Open standardcurl -s -X POST https://mcp.aadm.io/mcp \
-H "Content-Type: application/json" \
-H "Accept: application/json, text/event-stream" \
-d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"smoke","version":"1.0.0"}}}'
Each tool returns structured JSON for orchestrators and IDEs. After you connect, tools/list and inputSchema on the running server are authoritative — names below
match the hosted AADM MCP surface.
Wondering whether your framework or cloud is covered? See compatible stacks.
standard_brief One call loads workflow parity, orchestrator contract, follow-on catalog, and Sentinel assurance JSON hosts branch on.
route_lane When intent is already delivery, defect, or assurance, return deterministic routing metadata—no keyword roulette.
orchestrator_anchor Long-running jobs get a stable checklist: what to persist outside MCP, session notes, and when to refresh the brief.
plan_delivery Turn a task into UDALI-shaped delivery handoffs with doctrine-backed scope and integrator-ready language.
map_feature Seed layer and AUTH-XX hints from a short feature description—explicitly suggestive until your architecture confirms.
fetch_auth Pull the official markdown for a numbered AUTH control so prompts cite governance text, not paraphrase.
fetch_seam Load a SEAM-00–15 handoff archetype—scope for trace/assurance (normalization, dispatch, persistence). Pair with the seam-check worksheet resource.
role_guide Slice UDALI agent doctrine (Unifier, Designer, Adapter, Logician, Integrator) for the role and task you are in.
debug_defect Gated defect machine: Path A recon, Path B only after proof, execution-control appendix, and troubleshooter response gates.
debug_bundle Advanced hosts send a full integrated troubleshooter payload when they need the bundled diagnosis shape.
debug_hint Lightweight recon-vs-diagnose hint before you commit to a full debug_defect turn.
classify_bug Classify ownership and routing early so the right lane—not the loudest symptom—owns the next step.
triage_bug Map a rough symptom to suggested AUTH topics and stack band for intake before deeper debugging.
fix_pack After evidence and gates pass, emit an authorized fix prompt pack sized for coding agents—no premature refactor stories.
audit_interview Step through vertical depth and horizontal seams until scope is confirmable; then merge into outline-shaped intake.
audit_outline Produce the assurance scaffold: sections, checklist pointers, coder requests, and human-editable confirmation.
audit_run Plain-language “run an audit” asks become a program-aware intake plus top-findings brief for a repo-connected agent.
sentinel_programs Snapshot every bundled Sentinel audit program template without pulling the full standard_brief payload.
sentinel_program Fetch one audit program row by id when hosts only need that template’s rigor spine and evidence expectations.
sentinel_attestation_examples Shipped seam-tier examples so teams see how depth and boundaries translate to must-prove vs latent seams.
sentinel_closure Resolve closure tiers from attestation depth, vertical claim, and horizontal seams—deterministic seam language.
sentinel_stage_guide Gate helper for one assurance stage of a chosen program—keeps humans oriented inside the three-stage spine.
sentinel_handoff_hint After a sentinel_audit_exit_kind, get deterministic wording for staying in assurance or opening Navigator or Investigator.
sentinel_canonical_refs Curated resources/read URIs for delivery and assurance lanes so hosts wire doctrine without hunting the catalog.