Last updated: August 15, 2026
Model Context Protocol in regulated workflows
Kimss ships two MCP surfaces: an optional IDE MCP server (agent/run tools with a Kimss API key) and inbound customer MCP routing (vaulted HTTPS servers, Hermis intercept). Neither distributes raw provider secrets to every developer machine.
MCP standardizes how AI assistants discover and invoke tools. For enterprises, the value is consistency: the same workspace API key and RBAC boundary applies whether a human developer uses an IDE plugin or a service account calls REST directly.
IDE MCP mirrors a focused SDK subset—run agent, completions—not every billing or admin route. Inbound MCP is documented at /docs/routing_internal_mcp_servers.
Hermis intercepts each model tool_call before it reaches your MCP URL: kill switch, in-memory vault unwrap, then audit_log. Visual sequence: Zero-Trust AI architecture.
Security expectations for MCP clients
Treat MCP credentials like production API keys: store them outside source control, scope workspaces with X-Workspace-ID when needed, and rotate keys through workspace admin flows.
MCP does not bypass Kimss authentication. Each tool call resolves to the same governed backend as REST. Teams should document which MCP tools are approved in their environment and block unapproved local servers that embed unmanaged keys.
Full setup instructions live at /docs/python_sdk_mcp and the quickstart at /python-sdk-mcp-quickstart.
When MCP helps versus REST
Use MCP for developer ergonomics in Cursor, VS Code, or internal agent builders; use REST or the Python SDK for production services, CI pipelines, and long-running orchestration.
Production automation typically needs explicit error handling, retries, and idempotency patterns better expressed in application code with the kimss package. MCP accelerates interactive development while the /v1 API remains the durability contract.
Combine MCP exploration with architecture review at /docs/architecture before widening tool access in regulated accounts.
Enterprise rollout checklist
Approve tool list, configure Entra-backed workspace access, set governed-request allowances, pilot with a non-production workspace, then expand MCP configuration through your standard software distribution process.
Document which agents MCP users may create or run. Pair MCP adoption with /ai-rbac-and-identity guidance so directory groups align with workspace roles.