MCP integration roadmap

[patoperpetua]

Objective

Add Model Context Protocol (MCP) support to PostKit so AI agents can discover and invoke PostKit capabilities through a stable, secure interface while reusing the same application/core services as the REST API.

MCP must remain an adapter over PostKit core logic rather than a second implementation of email/template functionality.

Target architecture

REST API ──┐
           ├──> PostKit application/core services
MCP ───────┘

Initial hosting remains the existing Azure Function App. Do not introduce a separate container/VM/service unless a later PoC proves Azure Functions unsuitable.

Roadmap

1. MCP Iteration 1: stateless template inspection and preview #82 — Iteration 1: stateless template inspection and preview

   • Remote MCP endpoint in the existing Azure Function App
   • list_templates, get_template, get_template_schema, validate_template, preview_template
   • Temporary Bearer API-key authentication
   • No email sending

2. MCP Iteration 2: shared principal, API keys and scoped authorization #83 — Iteration 2: shared principal, API keys and scoped authorization

   • Transport-independent Principal
   • Tenant-bound API keys
   • Shared REST/MCP authorization
   • Granular permissions

3. MCP Iteration 3: Microsoft Entra ID OAuth/OIDC integration #84 — Iteration 3: Microsoft Entra ID OAuth/OIDC integration

   • Singleton Entra tenant as identity provider
   • PostKit App Registration representing the protected API
   • Delegated scopes for user flows
   • App roles/application permissions for machine-to-machine clients and agents

4. MCP Iteration 4: production hardening and privileged actions #85 — Iteration 4: production hardening and privileged actions

   • Auditability, rate limiting and security hardening
   • Environment safety controls
   • Evaluate/enable postkit.send_email
   • Measure Azure Functions before considering alternate hosting

Principles

• Reuse existing PostKit core/application services.
• Keep REST and MCP authorization semantics consistent.
• Tenant isolation must be enforced server-side.
• MCP must not expose raw provider credentials or arbitrary code execution.
• Prefer semantic tools over generic low-level endpoints.
• Keep the MCP server stateless where possible.
• Start with least-privileged capabilities.

Success criteria

An MCP-compatible client can securely connect to PostKit, discover supported tools, inspect and validate templates, and render a preview without bypassing PostKit tenant or authorization boundaries.