Operate Jelliu from an AI assistant

In this recipe you connect an AI assistant to your Jelliu workspace through the hosted MCP server, verify the connection from the command line, and use it to inspect agents, build a campaign and read results. You also set it up so the assistant can only do what you intend.

The MCP server reference lists endpoints, OAuth metadata and error codes. This page is the hands-on walkthrough.

What you will build

• An assistant that can answer questions like “which campaign converted best this week?” from live workspace data.
• A write-enabled setup that can create agents, load contacts and send messages, with confirmation before anything that costs money.
• A strictly read-only setup for reporting, enforced by the server rather than by the prompt.

How it works

Every tool is a thin wrapper over a REST endpoint. When the assistant calls a tool, the MCP server calls the API with the same credential, so the call passes the same scope checks, role gates, validation, rate limits and audit logging as a request you make yourself. The assistant can never do more than the key or token it holds.

Prerequisites

• A Jelliu workspace on an active plan. The MCP server is included in every current plan.
• For API-key clients: the workspace owner, to create a key in Settings → API Keys.
• One of: Claude Code, Cursor, Claude.ai (or another client that supports remote MCP servers over Streamable HTTP).
• curl, Node.js 18+ or Python 3.9+ with requests for the verification step.

Choose the credential and scope

How scope shapes what the assistant sees:

The read-only surface

https://mcp.jelliu.co/p/read-only serves only the tools that do not change anything, whatever the scope of the key you send. Use it for reporting assistants: even if someone later reuses a write key there, write tools are not listed at all.

Build it

export JELLIU_API_KEY="jl_..."

curl -sS https://mcp.jelliu.co/health

curl -sS -X POST "https://mcp.jelliu.co" \
  -H "Authorization: Bearer $JELLIU_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

<total> tools, 0 can change data
- jelliu_agents_list
- jelliu_agents_get
- jelliu_campaigns_list
- jelliu_calls_list
- jelliu_conversations_list
- jelliu_analytics_campaign
- jelliu_voices_list
...

claude mcp add --transport http jelliu https://mcp.jelliu.co \
  --header "Authorization: Bearer $JELLIU_API_KEY"

{
  "mcpServers": {
    "jelliu": {
      "type": "http",
      "url": "https://mcp.jelliu.co",
      "headers": {
        "Authorization": "Bearer ${JELLIU_API_KEY}"
      }
    }
  }
}

{
  "mcpServers": {
    "jelliu": {
      "url": "https://mcp.jelliu.co",
      "headers": {
        "Authorization": "Bearer jl_your_api_key"
      }
    }
  }
}

Example prompts

Keep it safe

What the server enforces

• Scope decides visibility. Tools a key cannot use are not listed, and admin-only operations are refused by the API even if called.
• Never available over MCP: creating or revoking API keys, billing purchases (checkout, minute packs, phone numbers) and contact data erasure. These stay in the dashboard.
• Compliance still applies. Sending messages and placing calls through the assistant goes through the same opt-out, do-not-contact and daily cap checks as the REST API.
• Destructive tools are marked. Deletes and jelliu_calls_initiate carry destructiveHint: true, which tells clients that honor annotations to ask before running them. The server’s own instructions also tell the model to confirm with you before calling them.
• Data from your systems is fenced. Tool results are passed to the model wrapped as external data, so text written by third parties (a CRM note, an email subject) is not treated as instructions.
• Suspended workspaces are cut off immediately, even if a session is open.

What you should configure

• Keep approval prompts on in your client for any tool that is not read-only. Do not enable “always allow” for jelliu_calls_initiate, jelliu_whatsapp_send, jelliu_email_send or any *_delete tool.
• Use the read-only surface (/p/read-only) for dashboards, BI and exploratory assistants.
• One key per person and client. Revoking one never disconnects the others, and activity stays attributable.
• Do not paste keys into prompts or chat history. Put them in the client configuration or an environment variable.
• Review what the assistant did. Every tool call writes one entry to the agent action ledger, with redacted parameters, outcome (success, error, denied) and duration.

Review the assistant’s activity

With a full key, read the ledger and filter by tool, outcome or time range:

curl -sS "https://api.jelliu.co/api/agent-actions?from=2026-09-14T00:00:00Z&limit=50" \
  -H "Authorization: Bearer $JELLIU_API_KEY"

Expected output:

2026-09-14T15:02:11.482Z jelliu_agents_list read success 184ms
2026-09-14T15:02:13.020Z jelliu_campaigns_create write error 97ms
2026-09-14T15:03:40.771Z jelliu_campaign_contacts_bulk_add write success 412ms

Query parameters: agentId, conversationId, callId, toolName, outcome (success, error, denied, timeout, indeterminate), actionKind (read, write, unknown), from and to (ISO 8601), limit (1 to 200, default 50) and offset. To stream these entries into your SIEM instead, subscribe a webhook to agent.action_recorded; see Webhooks.

Troubleshooting

Limits

Related