REST API
API keys for server-to-server work, constrained by scopes, domains, expiry and environment.
THE NYMWELL FOUNDATION
Domain infrastructure.
Ready for agents.
One control plane behind REST API and MCP, with explicit identity, policy, approval and audit boundaries.
Live control-plane preview · provider execution disabled
Hosted MCP
Sites-authenticated tools use the same organization and audit boundaries. Provider execution remains disabled.
identity → scoped credential → tool call → policy
├─ read: execute
└─ write: stage → human approval → execute → auditOne permission model, two access methods
REST and MCP resolve to the same organization, subject, scopes, domain allowlist, budget and approval policy. An agent cannot gain more authority by switching protocols.