MCP Server
The Code Effects MCP server (CodeEffects.Rule.Mcp) adds a Model Context Protocol endpoint to your ASP.NET Core application. MCP is the open standard AI clients use to connect to other systems: once your application offers the endpoint, a person can connect the AI client they already use (Claude on the web, desktop or phone, an AI coding tool, or your own agent), sign in with your company's identity provider, and ask their AI to work with your rules.
Why you would offer it. People who spend their day in an AI client can find, explain, write and test rules there, next to the documents and conversations that prompted the change, and investigate production decisions recorded by Audit without opening RR. Your own automation can use the same endpoint to read rules and run tests on a schedule. Your server pays nothing per token: the model runs at the AI client's vendor. To compare this with the AI built into RR's screens, see AI Assistant vs the MCP Server.
What stays under your control. The server never signs anyone in and never stores a credential: your application validates the token your identity provider issued and tells the server who the caller is and what they may do. An agent sees only the tools its caller's permissions allow, every call is checked again, and agents never publish, approve, decline or delete. Every rule an agent writes is checked against its source object before it is saved, so every rule version it saves is structurally valid, and the people who approve it review only its logic.
What an AI Client Can Do Through It
With the Rule Repository library added (WithRepository), within the caller's permissions:
- Find and read: source objects and their versions, members (fields, methods, actions, enumerations), data source items, rules, rule versions, drafts, which rules use a member, an overview of a source's rules.
- Write: check a rule written in the agent format, save it as a new rule, a new version or a draft (always requesting approval), rename and describe objects, convert a draft, see the impact of a change before making it.
- Test: try a rule on values, outline what a rule reads, create, update and run saved tests, keep values as value templates. Runs that call production methods need the person's yes.
- History: the user activity and a rule's history.
- Production (with Audit's records in the same database): find, read, summarize, explain and analyze recorded evaluations, explain why a call got its outcome, and how often an outcome occurs.
With Audit alone (WithAudit, no Repository): find, read and summarize recorded evaluations. With both, the Repository's richer evaluation tools serve instead, with explanations.
The full list is in Tools and Skills.
Requirements
- .NET 8 or later, ASP.NET Core. The MCP server is a .NET 8 package; Repository and Audit themselves stay .NET Standard 2.0. An application on .NET Framework can keep RR there and run the MCP server in a separate, small ASP.NET Core application on the same database.
- The Rule Repository library, Audit, or both. The MCP server is licensed only together with at least one of them.
- HTTPS, and your identity provider issuing tokens for the server (Microsoft Entra ID, Okta, Auth0 or any OAuth 2.0 / OpenID Connect provider).
- Reachable by the clients. A client that runs in its vendor's cloud (Claude on the web, desktop and phone connects from Anthropic's cloud, not from the user's computer) needs your server reachable from that cloud: a public address, or a firewall that allows the vendor's published IP ranges.
How It Fits Together
- A person adds your server's address to their AI client once.
- The client calls the server without a token; the server answers that sign-in is required and where your identity provider is.
- The client sends the person to your identity provider, with your company's usual multi-factor sign-in. The model never sees a password.
- Every call then carries the person's token. ASP.NET Core validates it; your
MapCaller delegate turns it into an McpCaller: the person, the AI client acting for them, and their permissions.
- The server lists only the tools those permissions allow, runs each call as that person through the same code RR's screens use, and records the AI client as the agent in the user activity.
The server is stateless: each call stands alone, so it runs behind a load balancer with no session affinity.
In This Section
- Setting Up the Server: the packages,
AddCodeEffectsMcp, WithRepository, WithAudit, MapCodeEffectsMcp and every option.
- Authentication and the Caller: token validation, the protected resource metadata, registering AI clients with your identity provider,
MapCaller.
- Tools and Skills: every tool, the skills, confirmations, what is refused.
- Connecting Users to Your MCP Server: what to tell your users, client by client.