AI integrations, tools, and authorization
Koodisi supports several ways to combine workflows and AI. Select the interface that matches the caller and the trust boundary.
| Capability | Use it when | Current Studio surface |
|---|---|---|
| NxAgent chat | A Studio user wants AI-assisted development or approved tool use | NxAgent panel |
| Chat or form surface | A person needs a hosted or embedded workflow experience | API Manager > Surfaces |
| MCP server | An AI client needs to discover and call governed API operations as tools | API Manager > MCP Servers |
| Headless API | Your application controls the experience and calls the workflow directly | API collection or surface endpoint |
| A2A | One autonomous agent communicates with another through an Agent-to-Agent protocol | Not exposed as a configurable Studio capability in the reviewed source |
How tools are created
- Publish workflow endpoints in an API collection.
- Generate and review the collection's OpenAPI contract.
- Create an MCP server and select the published specifications and operations.
- Assign each operation a Read, Write, or Destructive risk class.
- Apply scopes and claims from the server's security profile.
- Configure downstream credentials separately from client credentials.
See MCP servers for the complete procedure.
Authorization boundaries
Koodisi uses separate controls for separate hops:
- Human to Studio: organization membership, teams, permissions, and SSO.
- AI client to MCP server: OAuth application credentials, assigned users, scopes, and claims.
- Surface consumer to workflow: public access or bearer-token authentication.
- Tool to downstream system: an encrypted downstream API key, bearer token, basic credential, or managed resource.
Do not reuse one credential across these boundaries. Grant the smallest useful scope, treat write tools as privileged, rotate secrets, and review audit and usage data.
OpenAPI support
OpenAPI 3.x is the contract layer connecting workflow APIs, generated applications, activities, API collections, and MCP tools. Koodisi can import a contract, generate implementation assets, preserve registry references, and report impacts when linked operations change. Swagger 2.x is not supported by the current OpenAPI workflow.
A2A readiness
The reviewed Studio source does not contain an A2A route, configuration screen, agent card, task lifecycle, or authentication setup. Therefore this documentation does not claim A2A protocol support.
Before documenting A2A as available, the product should define:
- supported A2A protocol version and discovery document;
- agent identity, OAuth scopes, claims, and delegated authorization;
- task, message, artifact, cancellation, and retry behavior;
- streaming and callback support;
- audit, metrics, rate-limit, and data-retention behavior;
- interoperability and conformance test results.
Until then, use MCP for tool invocation and secured APIs or events for system-to-system orchestration.