Agents & MCP
A safe surface for agents — read summaries, draft tickets, nothing destructive
StepStitch plugs into any agent network over MCP, OpenAPI, or function-calling. The capability list is a single source of truth shared across all three surfaces, and it is deliberately read-only and draft-only. Agents help an operator move faster; they never take an irreversible action.
Three ways to connect, one capability list
MCP server
A universal connector for Copilot Studio, Claude, OpenAI, Bedrock, LangGraph, and any MCP client — the same safe operations everywhere.
OpenAPI spec
openapi-v2.json describes the read-only / draft tools for connector platforms that consume OpenAPI.
Function specs
The identical capability list, exposed as function-calling tool definitions.
Scope each agent — not just the surface
The list above is the ceiling for any agent. From the operator console you register each agent individually and issue it a named, revocable token scoped to a tier — so one connection gets summaries only while another can pull a repro. The host enforces the scope: an out-of-scope call is refused, not silently allowed, and every read and denial lands on the audit trail.
none
registered, no access
summaries
summaries · score · privacy posture
repros
+ the Playwright reproduction
drafts
+ sanitized ticket drafts
Agents can
- Read sanitized trace summaries (structure only, never raw footsteps)
- Read the replayability score and grade
- Read sanitized diagnostics and the recommended next step
- Read the privacy posture and scrub report
- Generate a deterministic Playwright reproduction
- Match a bug against the verified-fix corpus — “you’ve fixed this shape before”
- Get a signed, independently-verifiable evidence attestation
- Get a fragility map and a minimal repro for the failing path
- Create export-preview drafts (ServiceNow / Salesforce / Genesys / GitHub)
Agents cannot
- Delete or purge traces
- Change retention windows
- Trigger the kill switch
- Read raw traces, free-text explanations, or user identity
- Write to any system of record
- Open, approve, or merge a pull request
Human approval is the control point
An agent can assemble the evidence and hand a human a ready-to-review draft. The final action — filing the ticket, opening the PR, merging the fix — always belongs to a named person or your own CI. StepStitch supplies evidence, repros, drafts, and verification records; your systems and your people perform the final action.