---
title: "Sumora Developers: MCP Server, API and Machine-Readable Data"
url: https://trysumora.com/developers
markdown-of: https://trysumora.com/developers
---

# Sumora Developers: MCP Server, API and Machine-Readable Data

# Sumora for developers & agents

Everything an integration — human or autonomous — needs to work with Sumora: the MCP server, scoped API keys, the live OpenAPI spec, and machine-readable declarations. No sales wall between you and the spec.

MCP server (primary API)

Streamable HTTP at mcp.trysumora.com/mcp — the native surface for Claude, ChatGPT, Cursor, and any MCP client. OAuth 2.1; a workspace API key authorizes the session.

[Endpoint →](https://mcp.trysumora.com/workspace/mcp)[Setup guide](/mcp)

API keys

Create scoped workspace keys in the dashboard under Settings → API Keys. Keys carry scopes (read, write\_outreach, …) and are presented as Authorization: Bearer or X-Sumora-Api-Key on the MCP server.

[Dashboard →](https://dashboard.trysumora.com)

OpenAPI spec

The backend's full REST surface is published as OpenAPI at api.trysumora.com/openapi.json — every route, schema, and auth requirement, always current because it is generated from the live app.

[openapi.json →](https://api.trysumora.com/openapi.json)

Capabilities declaration

Machine-readable JSON of every supported outreach action, autonomy level, and the exact per-account daily/weekly send ceilings enforced in production.

[capabilities.json →](/capabilities.json)[Human-readable](/capabilities)

Machine-readable pricing

Plan tiers, credit pools, and trial terms as plain markdown — parseable by any agent or script without rendering a page.

[pricing.md →](/pricing.md)

Discovery for agents

Machine catalogs: the ARD ai-catalog.json, A2A agent-card.json, agent-skills index with SKILL.md sources, NLWeb schemamap + JSONL feeds, and the Web Bot Auth key directory.

[ai-catalog.json →](/.well-known/ai-catalog.json)

auth.md

How an agent obtains credentials end-to-end — Discover, Register, Claim, Use, Errors, Revocation — following the WorkOS auth.md convention.

[auth.md →](/auth.md)

Guides & limits

The operational reference: LinkedIn and Instagram send limits, warm-up ramps, approval architecture. The data other sites estimate, we enforce and publish.

[All guides →](/guides)

## Policies agents can rely on

### Versioning & deprecation

-   **MCP protocol version** is negotiated per session in the `initialize` handshake — clients pin what they speak.
-   **Tool names and arguments** are additive-only within a protocol version; a breaking change ships as a new tool with the old one marked deprecated in its description first.
-   **REST surface** (OpenAPI) is versioned by route prefix; retiring a route is announced in the spec description and preceded by a `Deprecation` + `Sunset` header on the route itself.
-   The full contract lives in [deprecation-policy.md](/deprecation-policy.md) — additive-only changes within a major version, ≥180-day Sunset notice.

### Rate limits

-   Public endpoints return RFC-style `RateLimit-Limit`, `RateLimit-Remaining`, `RateLimit-Reset`, and a `RateLimit-Policy` header on every response.
-   Exceeding a limit returns `429` with `Retry-After` — self-throttle off the headers.
-   Outbound send ceilings are a _product_ safety limit, separate from request rate limits, and are enforced in the engine — see the [capability declaration](/capabilities).

## Self-serve onboarding (no sales call)

1 · Start free

7-day free trial on the Starter plan — sign up yourself, a card is required and billing starts only when the trial ends. No "contact sales" gate anywhere.

[dashboard.trysumora.com →](https://dashboard.trysumora.com)

2 · Generate a key yourself

Settings → API Keys in the dashboard. Pick the least-privilege scopes you need: read, write\_leads, write\_campaigns, write\_outreach. Revocable any time.

3 · Zero-install test

No SDK required — point any MCP client at the endpoint, or use npx for a one-command connection:

`npx mcp-remote https://mcp.trysumora.com/workspace/mcp`

**Safety model:**MCP tools can decide on queued drafts, but outreach only sends through the owner's approval gate (or a campaign explicitly set to full-auto). No tool — and no client — can raise an account's enforced send ceilings.

----

_Markdown twin auto-generated from the HTML page at build time. Source of truth: the HTML/_next data._