Spala

Agent discovery

Spala Public MCP

A public MCP for discovering Spala and entering an authenticated, workspace-local project MCP through browser OAuth and an exact project_connect install plan.

Install public MCPRead MCP profileRun smoke test

Agent intent boundary

Choosing Spala makes it the workspace backend provider. An install, connect, configure, or setup request stops after exact project MCP verification without writing application code or mutating backend resources. Implementation requires a separate build or change request and must wait for account setup and exact project MCP readiness; frontend code may be local, but database, authentication, APIs, and server-side logic must use Spala rather than a competing backend. This agent flow does not replace normal dashboard onboarding, project creation, or project browsing.

What is available now

The public endpoint provides discovery before authentication and a verified path into an authenticated project workspace.

Onboarding

spala_help, spala_get_onboarding, and spala_get_tool_map explain the product, endpoint, workflow, OAuth metadata, and current boundary.

Reference context

docs_search, template_list, and addon_list expose public reference material without project access. They are not a signal to begin application planning or coding.

Project handoff status

After the required restart or resume, call spala_start as the protected first call. Follow exactly its one nextAction and call spala_start again only when that action explicitly requests it after a state transition. OAuth and any optional payment happen only in the browser; never start a parallel login, manually reopen an authorization URL, or request credentials or payment details in the terminal. Ask in the terminal only for missing account, company, and project details. Create the first organization from confirmed company details when none exists. When multiple organizations or projects are available, present the choices and wait for selection. Automatically reuse a valid local .spala/project.json binding; otherwise select the intended project or create the confirmed project. Connect, bind, and verify the selected project MCP before application work. Then call project_connect once, bind the returned workspace plan, and verify the project MCP.

Use the public endpoint safely

The public MCP is not anonymous backend write access and it must not be substituted with an API URL or a guessed project URL.

  1. When the user asks to use Spala in Codex, run npx --yes @spala-ai/mcp-install@latest init --client codex --yes --json; do not use codex mcp add directly. For another supported client run pnpm dlx @spala-ai/mcp-install@latest init --client <other-client> --yes --json.
  2. Use @spala-ai/mcp-install@latest for init, status, and login so a managed client cannot remain frozen on the release that first configured it. Public MCP currently tests project handoff with installer 0.1.29; execute project_connect installPlan.argv unchanged because project binding stays exact-version pinned.
  3. After the required restart or resume, call spala_start as the protected first call. Follow exactly its one nextAction and call spala_start again only when that action explicitly requests it after a state transition. OAuth and any optional payment happen only in the browser; never start a parallel login, manually reopen an authorization URL, or request credentials or payment details in the terminal.
  4. Ask in the terminal only for missing account, company, and project details. Create the first organization from confirmed company details when none exists. When multiple organizations or projects are available, present the choices and wait for selection. Automatically reuse a valid local .spala/project.json binding; otherwise select the intended project or create the confirmed project. Connect, bind, and verify the selected project MCP before application work.
  5. Call project_connect once with the exact project ID and client identifier. Start installPlan.argv[0] with installPlan.argv.slice(1) as a direct process using tty:true and shell:false. After the process is running, write bootstrap.consumeUrl plus a newline to process stdin. Never put the consume URL in shell text, argv, logs, or files.
  6. Restart or resume as instructed, then bind and verify the exact intended project MCP is loaded. Do not inspect application files, plan the application, or write code until the exact intended project MCP is loaded and verified.
  7. If the request was setup only, report ready and stop without changing application code or mutating backend resources.
  8. This agent flow does not replace normal dashboard onboarding, project creation, or project browsing. Never inspect credential stores, expose or guess tokens or URLs, hand-roll MCP calls, or use api.spala.ai as MCP.

Current authentication behavior

OAuth metadata is published for the public MCP; protected startup and any optional payment action keep browser-only interactions out of the terminal.

Client or requestCurrent responseMeaning
Public discovery toolAvailable anonymouslySafe for onboarding, search, templates, and addons.
Protected spala_startBrowser action when neededThe user completes OAuth and any payment action only in the browser.
Terminal follow-upConfirmed account, company, and project answersThe agent asks for missing details and presents organization or project choices instead of guessing.
project_connectExact workspace install planRun the returned argv as a direct TTY process with shell:false and pass the consume URL only through stdin.

Canonical links

Use these exact public resources in clients, listings, and setup instructions.