Every app's ontology as an API and MCP tools, for each caller.
Every app in a workspace serves its ontology as a REST API with an OpenAPI reference, and as an MCP server at /mcp. People connect their agents with OAuth and the agent acts as them, with tools only for what their roles allow. Nothing to write: the tools come from the ontology.
Get started
$ claude mcp add --transport http crm https://crm.example.com/mcpAt a glance
- Every app serves its ontology at /mcp and /api/ontology
- Members connect agents with OAuth and choose full or read-only access
- Tools listed per caller's roles, and every call checked again
- API keys for unattended work, with exactly their roles
What it does
Agents sign in as the person
Add the app's /mcp address to Claude, ChatGPT or Claude Code. The member signs in on the app's own page and chooses everything their roles allow, read only, or deny. The agent gets a one-hour token that works only on that app.
Tools per role
tools/list holds describe, me, aggregate and, per entity, find, get, history and the actions the caller may run. A role without deal:moveStage never sees deal_move_stage, and every call is checked again.
describe me aggregatedeal_find deal_get deal_history deal_move_stagelead_find lead_get lead_history lead_claim lead_qualifyErrors an agent can act on
A refused call is a tool error with the action's own message, so the agent can fix its input. Actions that change data are flagged, and clients ask the person before running them.
API keys for unattended work
Jobs that run with nobody signed in use an API key. It holds exactly the roles it was created with, and history names its service user.
$ segmentstream ontology mcp --create-key nightly-report --role salesREST and OpenAPI
The same operations are a REST API at /api/ontology, with an OpenAPI reference at /api/ontology/docs. One code path serves REST and MCP, so a rule enforced in one is enforced in both.
GET /api/ontology/lead/{id}POST /api/ontology/lead/queryPOST /api/ontology/lead/actions/qualifyGET /api/ontology/docsThe rest of the surface
Ontology SDK
@segmentstream-cloud/ontology
Entities, actions and roles; REST, OpenAPI and MCP from one model
App SDK
@segmentstream-cloud/app
Email-code sign-in, roles, records and warehouse data for Next.js
Pipeline SDK
segmentstream-pipeline (Python)
Connections, ingestion, models, checks and schedules in Python
Agent SDK
@segmentstream/agent
The company agent: ontology tools as the member, Telegram channel
CLI
segmentstream
Workspaces, deploys, members, jobs and data from the terminal
Your company’s software, built by agents, owned by you.
$ segmentstream workspace create acme --region eu --subdomain acme
▸ Created workspace acme · database, warehouse and a private git repository
$ segmentstream workspace WORKSPACE-ID clone acme && cd acme
▸ your agent writes the five folders and runs the checks
$ git add -A && git commit -m "First version"
$ segmentstream deploy
▸ app, ontology API and MCP tools live for your invited members
Our engineers build the first version on your data in two weeks, at a fixed price.
Or join the waitlist for self-serve:
Self-serve opens to the waitlist first.