Copy page

MCP server

The PokerWorks Developer API MCP server is the agent-native automation path for public-preview Developer Platform workflows. It lets a coding agent use a scoped service-account management token to read account state, create approved embed sessions, manage webhook endpoints, inspect delivery evidence, replay deliveries, emit playground tournament completions, and fetch public-safe tournament result/proof reads.

Connect an agent

The MCP server authenticates with a service-account management token (pw_mgmt_…). Give any agent only the scopes it should have — the agent can do exactly what the token allows, and every action is recorded in the audit log.

Run the server from a checkout that has access to the PokerWorks workspace:

Code
export POKERWORKS_DEVELOPER_API_MANAGEMENT_TOKEN="pw_mgmt_…"
pnpm ops:developer-api:mcp:serve

The optional POKERWORKS_DEVELOPER_API_BASE_URL env var overrides the default https://api.pokerworks.io/api/v1 for local or staging runs.

Example MCP client configuration:

Code
{
  "mcpServers": {
    "pokerworks-developer-api": {
      "command": "pnpm",
      "args": ["--dir", "/path/to/pokerworks", "ops:developer-api:mcp:serve"],
      "env": {
        "POKERWORKS_DEVELOPER_API_MANAGEMENT_TOKEN": "pw_mgmt_…"
      }
    }
  }
}

Replace /path/to/pokerworks with your local checkout. The --dir flag matters because MCP clients can launch servers from outside the repository.

Available tools

Tool	Input
developer_api_account_get_v1	{}
developer_api_projects_list_v1	{}
developer_api_project_create_v1	{ "name": string, "allowedOrigins"?: string[] }
developer_api_project_update_v1	{ "projectId": string, "name"?: string, "allowedOrigins"?: string[] }
developer_api_keys_list_v1	{}
developer_api_key_create_v1	{ "projectId": string, "label": string, "environment"?: "test" | "live", "expiresAt"?: string, "scopes"?: ("account:read" | "calculations:read" | "usage:read")[] }
developer_api_key_revoke_v1	{ "keyId": string }
developer_api_usage_get_v1	{ "environment"?: "test" | "live", "limit"?: number, "projectId"?: string }
developer_api_billing_get_v1	{}
developer_api_audit_events_list_v1	{ "actorType"?: "user" | "service_account" | "system", "before"?: string, "limit"?: number, "targetType"?: string }
developer_api_embed_products_list_v1	{}
developer_api_embed_session_create_v1	{ "projectId": string, "productKey": string, "origin": string, "environment"?: "test" | "live", "returnUrl"?: string, "tableId"?: string, "idempotencyKey"?: string }
developer_api_embed_session_get_v1	{ "embedSessionId": string }
developer_api_playground_tournament_completion_emit_v1	{ "projectId": string, "fixture"?: "completed-six-max-nlhe-v1" }
developer_api_tournament_result_proof_get_v1	{ "tournamentId": string }
developer_api_webhook_endpoints_list_v1	{ "environment"?: "test" | "live", "limit"?: number, "projectId"?: string, "status"?: "pending_verification" | "active" | "disabled" | "deleted" }
developer_api_webhook_endpoint_create_v1	{ "projectId": string, "label": string, "url": string, "environment"?: "test" | "live", "eventTypes"?: "tournament.completed"[] }
developer_api_webhook_endpoint_get_v1	{ "endpointId": string }
developer_api_webhook_endpoint_update_v1	{ "endpointId": string, "label"?: string, "url"?: string, "status"?: "active" | "disabled", "eventTypes"?: "tournament.completed"[] }
developer_api_webhook_endpoint_rotate_secret_v1	{ "endpointId": string }
developer_api_webhook_endpoint_delete_v1	{ "endpointId": string }
developer_api_webhook_deliveries_list_v1	{ "environment"?: "test" | "live", "limit"?: number, "projectId"?: string, "endpointId"?: string, "eventId"?: string, "status"?: "pending" | "scheduled" | "delivering" | "succeeded" | "failed" | "abandoned", "before"?: string }
developer_api_webhook_delivery_replay_v1	{ "deliveryId": string }

List/read tools are marked read-only. Create/update tools are non-idempotent. Revoke, delete, and secret-rotation tools are marked destructive so agents can ask for confirmation before using them.

The developer_api_tournament_result_proof_get_v1 tool requires a management token with tournament_result_proofs:read scope and returns the same public-safe result/proof DTO as GET /api/v1/developer-api/management/tournaments/{tournamentId}/result-proof.

The developer_api_playground_tournament_completion_emit_v1 tool requires playground:write and tournament_result_proofs:read, only emits in the test environment, and queues a signed tournament.completed delivery for active test webhook endpoints. Use it to prove a recipe loop before switching to live project events.

Recipe servers consume the same result/proof read after verifying the signed tournament.completed delivery and following links.resultProof.href. That keeps Discord announcements, Google Sheets exports, and agent proof transcripts grounded in one result contract.

Safety

• The agent is bound to the service account's scopes; it cannot exceed them.
• Tokens are revocable at any time from the console — revoke to cut an agent off immediately.
• Use management tokens only in server-side MCP processes. Do not place pw_mgmt_… tokens in browser code, public repositories, or client-side configuration.

Related

• Service accounts & management tokens
• Guide: Automate with a service account