API, MCP and CLI coverage

HTTP API

POST /api/v2/execute accepts the full shared operation envelope and validates it against the contract registry. Access requirements vary by operation: account-scoped operations accept an authorized bearer token or signed-in browser session where allowed; reports.read instead needs its per-report capability, and feed.list needs updates:read when tab is following. Browser-session-only operations reject bearer tokens. Use the linked operation reference for exact access metadata and input requirements.

MCP

MCP exposes the curated mcpOperationNames allowlist through named tools and invoke_operation. It excludes session-only operations, email signup, and sponsor impression/click tracking. Each available tool still uses the operation ownership, entitlement and scope checks.

CLI

The repository CLI provides convenience commands plus call OPERATION [JSON|-] for shared operations. Run `indielogs operations --details` to inspect each operation name, authentication mode, required scope and MCP availability. The CLI is a bearer-token client with no browser-cookie mode, so browser-session-only operations require the web app. Project ownership, token scope and feature/provider prerequisites still apply.

Synthetic review-draft example

The following example is intentionally synthetic. Project ID 7 is a placeholder; do not run it against a live workspace. If you replace it with an owned test project and execute it, the operation records evidence and may call the configured AI Gateway, consumes the applicable budget, and creates or reuses a draft for review. It never publishes. It requires drafts:write, an eligible account/project, OUTBOUND_ENABLED and configured Gateway models. Repeating the same key with identical evidence returns the existing result.

node apps/cli/bin/indielogs.mjs agent-draft --project 7 --summary "Synthetic documentation example: add a dark-mode toggle" --why "Synthetic test evidence only; no user data or real commit." --key "docs-example-project-7-dark-mode"

HTTP version of the example

This is the same synthetic example using the normalized API operation. It is documentation only and was not executed:

curl -X POST "$INDIELOGS_URL/api/v2/execute" -H "Authorization: Bearer $INDIELOGS_TOKEN" -H "Content-Type: application/json" -d '{"version":1,"operation":"drafts.from_evidence","input":{"project":7,"summary":"Synthetic documentation example: add a dark-mode toggle","why":"Synthetic test evidence only; no user data or real commit.","idempotencyKey":"docs-example-project-7-dark-mode"}}'

Publishing is separate

Draft creation does not grant publish authority and does not publish automatically. Publishing needs a separate updates:publish scope, an explicit publish operation, and a draft that has passed its review/hold checks. Resolve any hold and review the evidence before publishing.