Tityra

Tityra MCP server documentation

Connect Tityra to your agent with MCP. Read public audit options or use OAuth to work with the customer projects and permissions you approve.

Choose your MCP connection
MCP reference in Markdown

PUBLIC WEBSITE TOOLS

Read audit options and prepare an unsubmitted review link.

CUSTOMER ACCOUNT ACCESS

Use selected projects with approved OAuth permissions.

CONNECT OVER MCP

Read the Streamable HTTP connection details and boundaries.

Choose your MCP connection

Tityra has two separate Model Context Protocol servers. Use https://tityra.com/mcp for public website information and request preparation. Use https://app.tityra.com/mcp for customer account work with the projects and permissions the account holder approves.

Both use remote Streamable HTTP. The public website connection requires no account or access token. The customer connection requires OAuth authorisation; anonymous website access grants no customer account permissions.

Anonymous website MCP server

Connect your MCP client to https://tityra.com/mcp. The get_audit_options tool reads current audit options. The prepare_audit_request tool prepares a review link using the scope supplied by the user.

Preparation does not submit an audit request, start a scan, access customer reports or make a payment. The website owner or authorised representative reviews the link and completes the existing verified website form.

Connect and discover the public toolsTerminal

curl --fail --silent --show-error 'https://tityra.com/mcp' \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -H 'MCP-Protocol-Version: 2025-11-25' \
  --data '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-11-25","capabilities":{},"clientInfo":{"name":"tityra-public-quickstart","version":"1.0.0"}}}'

curl --fail --silent --show-error 'https://tityra.com/mcp' \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -H 'MCP-Protocol-Version: 2025-11-25' \
  --data '{"jsonrpc":"2.0","id":2,"method":"tools/list","params":{}}'

Compare packages in MCP Apps

MCP clients with Apps support can display the public audit options as an interactive comparison. The get_audit_options tool advertises the UI resource ui://tityra/audit-options/v1.html. The view reads the same public tool result; it has no account access, submission control or payment operation.

The interface is optional. Clients without Apps support retain the standard text and structured JSON result. After initialising the public connection, use resources/list to discover the resource and resources/read with its URI to retrieve the sandboxed HTML.

Discover the optional public comparison UITerminal

curl --fail --silent --show-error 'https://tityra.com/mcp' \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -H 'MCP-Protocol-Version: 2025-11-25' \
  --data '{"jsonrpc":"2.0","id":4,"method":"resources/list","params":{}}'

Customer account MCP server

Connect an OAuth-capable MCP client to https://app.tityra.com/mcp. The account holder signs in, reviews the requested permissions and selects projects. Existing account permissions, report release and payment rules apply.

Depending on the granted scopes, connected agents can work with audit requests, released reports, findings and customer-visible discussions. Private staff notes are excluded. Additional permissions require a new consent request; an existing connection does not receive wider access automatically.

Where checkout permission is granted, an agent can prepare a checkout link for the customer to review and complete. It cannot charge a card automatically.

Use the separate public A2A interface

The public A2A interface at https://tityra.com/a2a uses the A2A 1.0 JSON-RPC binding. It is a separate interface from MCP. Read its Agent Card at https://tityra.com/.well-known/agent-card.json, then send a SendMessage request with A2A-Version: 1.0. A successful response contains result.message with ROLE_AGENT and text or JSON parts.

Send a text part saying Read audit options, optionally followed by for free, for automated or for human. A JSON data part can use operation: get_audit_options with an optional plan. The example below reads current public packages without credentials.

For preparation, send a data part with operation: prepare_audit_request, a plan and a public websiteUrl. The response is an unsubmitted draft with submitted:false and a reviewUrl. Supply no contact details, credentials, query parameters or URL fragments. The owner still reviews and submits the verified form; no target website is fetched during preparation.

This interface returns immediate messages and does not store tasks. It does not stream, send push notifications or expose an extended authenticated card. Task reads and cancellation return TaskNotFoundError; streaming and task listing are unsupported. There are no account, private-report, scan, submission or payment operations. Requests are limited to 8 KiB and 120 per client/process per minute; browser Origins must match the website policy.

Read public packages through A2A 1.0Terminal

curl --fail --silent --show-error 'https://tityra.com/a2a' \
  -H 'Content-Type: application/json' \
  -H 'A2A-Version: 1.0' \
  --data '{"jsonrpc":"2.0","id":1,"method":"SendMessage","params":{"message":{"messageId":"public-options-example","role":"ROLE_USER","parts":[{"data":{"operation":"get_audit_options"},"mediaType":"application/json"}]},"configuration":{"acceptedOutputModes":["application/json"]}}}'

API, CLI and source references

Use the API documentation for public endpoints and examples. The CLI uses the customer API with selected projects and approved permissions. Tityra publishes its public repositories through the Tityra-UK GitHub organisation.