# MCP overview

> The Flax Model Context Protocol server — expose your semantic layer to agents, with all access enforced by the caller's scopes and RLS

*[View this page in the Flax docs](https://flax-analytics.com/docs/developers/mcp-overview)*

The Flax MCP server exposes the platform as [Model Context Protocol](https://modelcontextprotocol.io) tools, so an agent such as Claude can discover your semantic layers, validate queries, and build charts and dashboards. This page is for developers connecting an MCP client to Flax.

## What it is

MCP is a thin wrapper over the [REST API](/docs/api-reference/overview): each tool maps 1:1 to an endpoint. The agent follows a natural workflow — **discover** semantic layers and models, **validate** a query without saving, then **create** charts, sheets, and dashboards. See the full list in [MCP tools](/docs/developers/mcp-tools).

## Security model

The MCP server **adds no privilege of its own.** Every call is authorized by:

- the caller's token **scopes** (`read` to explore, `write` to create or update), and
- the service account's or user's **team membership and row-level security**,

all enforced server-side by the API. An agent can never see or change anything its principal could not reach directly.

## Two ways to connect

| Mode | Transport | Auth | Use it for |
| --- | --- | --- | --- |
| [Local](/docs/developers/mcp-local) | stdio, via the `flax-mcp` binary | a service-account [API token](/docs/developers/authentication) | your own machine, CLIs like Claude Code |
| [Hosted](/docs/developers/mcp-hosted) | HTTP, `POST /mcp` | [OAuth](/docs/developers/oauth) | shared/remote clients with interactive login |

Both expose the identical tool set.

## Next steps

- [Local MCP server](/docs/developers/mcp-local)
- [Hosted MCP](/docs/developers/mcp-hosted)
- [MCP tools reference](/docs/developers/mcp-tools)