It speaks Streamable HTTP with JSON-RPC 2.0. Create the token in the dashboard under Settings then API.
The token is embedded in the URL, because most MCP clients cannot send custom headers. Treat the entire URL as a secret. Revoke the token to cut off access.
An active paid plan is required, Lite or above. The 7 day free trial counts.
The MCP server enforces the same token abilities as the REST API. A read-only token can list and read, but any attempt to write comes back as a tool error. Give an agent a read-only token when you only want reporting.
An agent acts with the full power of the token you hand it. Deleting an element is irreversible. Grant elements:write and profiles:write only when you actually want the agent changing your page, and review what it changed.