Configure the Local MCP Server

Use @y2-intel/mcp for a local stdio connection. This guide uses version 0.2.0. For hosted OAuth connections, see Connect Y2 through MCP.

Before you begin

You need Node.js 20 or later and an MCP client with stdio support. Public documentation and OpenAPI discovery do not need a key. For authenticated tools, create a key with only the scopes you need. Set Y2_API_KEY in your client environment.

Verify public discovery

Run this command without an API key:

npx -y @modelcontextprotocol/inspector --cli npx -y @y2-intel/[email protected] \
  -- \
  --method tools/call \
  --tool-name y2_list_api_operations

The response lists operations from Y2's OpenAPI document. This confirms that the server starts and can read the contract.

Configure your client

Add the stdio server from a shell where Y2_API_KEY is set:

codex mcp add y2 --env Y2_API_KEY="$Y2_API_KEY" -- npx -y @y2-intel/[email protected]

Confirm that the configuration exists:

codex mcp list

The --env value is saved with the MCP server configuration. Protect the client configuration file as a secret.

Omit Y2_API_KEY if you need only public discovery. Keep credentials out of prompts and tool arguments.

Verify tools

Inspect the installed tools:

npx -y @modelcontextprotocol/inspector --cli npx -y @y2-intel/[email protected] \
  -- \
  --method tools/list

Version 0.2.0 exposes 52 tools by default. Ask your client to call y2_list_reports with a reports:read key. Expect a report list, which can be empty. Verify this read before you enable action tools.

Call an API operation

Call y2_list_api_operations to find the operationId.
Call y2_get_openapi_operation to read its parameters and schema.
Call y2_call_api with the operation ID and required inputs.

Example tool arguments:

{
  "operationId": "listReports",
  "parameters": {
    "limit": 10
  }
}

The tool builds the request from OpenAPI. The API key must grant the selected operation's scopes.

Use a read-only key for read-only work

Y2_MCP_ENABLE_WRITE_TOOLS=false hides dedicated write tools. It does not remove scopes from the key or restrict y2_call_api.

See MCP reference for configuration, optional tools, and troubleshooting.