Configure Enterprise MCP

Enterprise MCP is the published capability surface Role Assistants and MCP clients consume after upload — compiled from certified Business Entity manifests, not raw vendor APIs.

Prerequisites

Business Entities with exposed contracts and capabilities[] defined
Green validate and successful upload
OpenAPI and MCP contracts understood at a high level

Where it lives

Layer	Role
Business Entity	`exposed`, `capabilities`, `execution.cip.operations` — what may publish
Connected System	`generateMcpContract`, certification block
Runtime	Enterprise MCP tools after upload (same governed keys as REST)

This page is the configure outcome for operators and integrators. Deep contract reference: Enterprise MCP and Enterprise MCP reference.

Builder MCP


Manifest sections	`datasource.capabilities`, `datasource.exposedAttributes`, `datasource.mcpOperations` (entity); system certification block
Help topics	`section`, `goldenExamples`, `evidencePatterns`, `connectedSystemUi`
Repair hooks	`expose`, `rbac`

Publish proof uses CLI show --online and certification pillars — not Builder API upload alone. Ladder: Certification.

How to set

Enable exposure on each Business Entity — exposed.schema, exposed.filterable, and root capabilities[].
Align capability keys with RBAC permission prefixes (customer:get, document:search).
Set datasource externalSpec — authoritative vendor operation source for compilation (system OpenAPI is connectivity only).
Upload and verify online contract:

aifabrix repair <systemKey> --expose
aifabrix validate <systemKey>
aifabrix upload <systemKey> --probe
aifabrix show <systemKey> --online

Run certification pillars before production Role Assistant use.

Defaults and examples

Enterprise MCP tools map to deduplicated business capability keys — one tool per governed action. Tool inputs use normalized metadata from fieldMappings, not vendor field names.

On each Business Entity, capabilities[] declares which governed actions publish to MCP. exposedAttributes (or exposed.schema) defines the normalized input surface Role Assistants and external MCP clients see. The Connected System generateMcpContract flag (when present) signals that compiled MCP metadata should ship with upload — confirm with show --online rather than assuming local JSON is live.

Illustrative Business Entity fragment — capability keys bound for Enterprise MCP after upload:

{
  "key": "example-companies",
  "capabilities": [
    {
      "key": "company:get",
      "displayName": "Get company",
      "enabled": true,
      "riskLevel": "low"
    },
    {
      "key": "company:search",
      "displayName": "Search companies",
      "enabled": true,
      "riskLevel": "medium"
    }
  ],
  "exposed": {
    "schema": {
      "type": "object",
      "properties": {
        "companyId": { "type": "string", "index": true },
        "name": { "type": "string" },
        "region": { "type": "string" }
      }
    },
    "filterable": ["region", "ownerId"]
  },
  "mcpOperations": {
    "enabled": true,
    "toolPrefix": "example_crm"
  }
}

Set enabled: true only on capabilities that passed validation and governance review. Disabled capabilities must not appear as live MCP tools after upload. Tool names in the online contract use the deduplicated capabilities[].key — not vendor operation IDs from externalSpec.

Connected System certification block (typical defaults):

Field	Default intent
`generateMcpContract`	Compile MCP from entity exposure when true
Certification pillars	Operations, trust metadata, governance — run before production Assistants

Check	Command / surface
Compiled contract online	`aifabrix show <systemKey> --online`
Operations proof	`aifabrix verify-operations <systemKey>`
Trust metadata	`aifabrix verify-trust <systemKey>`
Governance	`aifabrix verify-governance <systemKey>`

After upload, compare online MCP tool list to capabilities[] keys. A missing tool usually means enabled: false, a capability key mismatch with CIP operations, or exposure not yet repaired. Re-run repair --expose before re-upload when local manifests drift from the published contract.

Validate

aifabrix show <systemKey> --online
aifabrix verify-operations <systemKey>
aifabrix test-e2e <systemKey>

Common mistakes

Mistake	Fix
Testing MCP before upload	Upload first; local JSON is not the contract
System OpenAPI treated as entity contract	Set `externalSpec` per Business Entity
Decorative capability keys	Match `capabilities[].key` to CIP/OpenAPI operations
Skipping governance pillar	Run full certification ladder

Documentation Index