PlatformPilot
for developers and agents.

1. Create an account at https://platformpilot.ai/get-started. Sign-up is self-serve with email or Google; the onboarding flow creates your organization and its brain.
2. Register the Brain MCP server with your agent. The fastest path is to paste https://platformpilot.ai/agent-setup/prompt.md into the agent and let it run the steps below itself.
3. Sign in when the OAuth window opens on first tool use. Tokens are scoped per client and can be revoked from the dashboard.
4. Recall before you write: call recall_context or search_memories at the start of a task, record what you learned with manage_memories when you finish, and report how the recalled memories worked with feedback_memories.

claude mcp add platformpilot-brain --transport http --url https://mcp.platformpilot.ai/brain/mcp

{
  "mcpServers": {
    "platformpilot-brain": { "url": "https://mcp.platformpilot.ai/brain/mcp" }
  }
}

from agents import Agent
from agents.mcp import MCPServerStreamableHttp

brain = MCPServerStreamableHttp(params={"url": "https://mcp.platformpilot.ai/brain/mcp"})
agent = Agent(name="my-agent", mcp_servers=[brain])

The brain is exposed as a Model Context Protocol server at https://mcp.platformpilot.ai/brain/mcp over the Streamable HTTP transport. It is the same memory PlatformPilot's own agents read and write, so anything your agent records is visible to every other client connected to your organization.

Authentication follows the MCP authorization specification: an unauthenticated initialize returns 401 with a WWW-Authenticate challenge, the protected resource metadata names the authorization server, and clients register dynamically and complete an authorization-code flow with PKCE (S256).

Tool listing requires a signed-in organization because tool availability depends on plan entitlements. The five tools above are the core public surface. Organizations with the entity graph enabled also see explain_entity, entity_path, and affected_entities, which explore how the people, systems, and organizations in the brain relate, citing the memory that asserted each relationship.

The Agents API at https://api.platformpilot.ai is the system of record behind the dashboard: organizations, users, teams, memory graph and memory seeding, investigations (threads and runs), scheduled jobs, playbooks, integrations and MCP configuration, webhooks, alerts, billing, and evaluation. The OpenAPI 3.1 document lists 412 operations across 316 paths; every operation has a unique operationId, a description, typed parameters, and response schemas.

curl -s https://api.platformpilot.ai/organizations \
  -H "Authorization: Bearer $PLATFORMPILOT_ACCESS_TOKEN" \
  -H "Accept: application/json"

The public Web API on https://platformpilot.ai is separate and needs no credentials: a JSON blog feed, semantic blog search, platform status, and the discovery files listed on this page. It is described by https://platformpilot.ai/openapi.json and indexed at https://platformpilot.ai/api.

PlatformPilot uses OAuth 2.0. The authorization server is https://auth.platformpilot.ai/ and its metadata is published at https://platformpilot.ai/.well-known/oauth-authorization-server (also mirrored as OpenID Provider configuration). Access tokens for the REST API are JWTs issued for the audience https://api.platformpilot.ai; send them as Authorization: Bearer <token>.

• Interactive clients (MCP clients, CLIs, dashboards): authorization code flow with PKCE (S256). MCP clients discover the server through the protected resource metadata and may register dynamically at the registration_endpoint.
• Server-to-server: client_credentials with a confidential client issued for your organization.
• API keys: operations in the Agents API spec also accept an x-api-key header. Keys are created from the dashboard for your organization and should be treated like passwords: rotate from the same place.
• Machine payments: the Brain can sell access passes to autonomous agents through the Machine Payments Protocol. POST https://platformpilot.ai/api/agent/brain-pass answers 402 with a signed WWW-Authenticate: Payment challenge and settles on retry.

Never embed user tokens in prompts or logs. Tokens are short-lived; refresh tokens are only issued when offline_access is requested and are bound to the client that obtained them.

Every Web API response carries the IETF RateLimit and RateLimit-Policy headers, the widely used RateLimit-Limit, RateLimit-Remaining, and RateLimit-Reset names, and an API-Version header. Throttled requests return 429 Too Many Requests as an RFC 9457 problem document with Retry-After set to the seconds until the window resets. Limits are per client IP and per policy.

RateLimit-Policy: "public-read";q=60;w=60
RateLimit: "public-read";r=57;t=43
RateLimit-Limit: 60
RateLimit-Remaining: 57
RateLimit-Reset: 43
API-Version: 1

Limits on the Agents API depend on your plan (Professional raises the webhook event limits, for example) and are enforced per organization. Throttled requests return 429; honor Retry-After when present and back off exponentially otherwise.

• Web API: versioned in the URL path. /api/v1/ is the current major version and every response carries API-Version: 1. The unversioned /api/... paths are aliases of v1 and will keep resolving to v1 even after a v2 ships.
• Agents API: versioned with semantic versioning in info.version of the OpenAPI document (currently 1.0.0). Additive changes (new operations, new optional fields, new enum values) ship within a major version. Breaking changes only ship under a new major version at a new base path, and the previous major keeps working for the deprecation window.
• Deprecation signalling: an operation scheduled for removal is marked deprecated: true in the OpenAPI document and its responses carry a Deprecation header (RFC 9745) and a Sunset header (RFC 8594) with the removal date, at least 90 days ahead. The replacement is linked with Link: <...>; rel="successor-version".
• Where changes are announced: the blog (category Product or Engineering), the status page, and the OpenAPI documents themselves. Agents can diff https://api.platformpilot.ai/openapi.json to detect changes.

• Markdown content negotiation: request any page with Accept: text/markdown and you get text/markdown; charset=utf-8 with Vary: Accept. Quality values are honored, an Accept that excludes both HTML and Markdown gets 406, and every HTML response advertises its twin with Link: <...>; rel="alternate"; type="text/markdown".
• Markdown siblings: append .md to a page path (/about.md, /blog/<slug>.md, /index.md for the home page) to fetch the Markdown without a special header.
• llms.txt: https://platformpilot.ai/llms.txt summarizes the product, lists when to use it, and links every machine-readable surface. https://platformpilot.ai/llms-full.txt is the long form.
• Blog feed: https://platformpilot.ai/api/v1/blog/posts lists posts with agent summaries, when-to-use notes, key claims, and related concepts; /api/v1/blog/posts/{slug} adds the full text.
• 404s: unknown paths return a real HTTP 404. With Accept: text/markdown the body is a short Markdown site map pointing at https://platformpilot.ai/sitemap.xml, llms.txt, and this page.
• Discovery files: robots.txt, sitemap.xml, openapi.json, .well-known/oauth-authorization-server.

curl -sI -H "Accept: text/markdown" https://platformpilot.ai/ | grep -iE "^(content-type|vary)"
curl -s -o /dev/null -w "%{http_code}\n" https://platformpilot.ai/a-path-that-does-not-exist
curl -s https://platformpilot.ai/.well-known/oauth-authorization-server | jq .issuer

• Self-serve: sign up at https://platformpilot.ai/get-started with email or Google. No sales call is required for Starter or Professional.
• Trial: when a plan carries a trial it is offered at checkout with the length shown before you confirm; the Brain MCP server is available during the trial. Plans and prices are listed at https://platformpilot.ai/#explore-plans.
• Isolation: every organization runs in its own isolated setup, so a second organization is a safe place to experiment. There is no separate public sandbox environment today; for an evaluation tenant with seeded data, book a demo.
• Billing regions: customers in the EU, EEA, UK, and Switzerland are billed by PlatformPilot Limited in EUR; everyone else by DynG AI, Inc. in USD. Region is detected at checkout.