> ## Documentation Index
> Fetch the complete documentation index at: https://acem-52171079.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Architecture

> Technical stack, data flow, and authentication

The MCP Server provides a standardized interface for agents to communicate with the DataDot backend.

## Tech Stack

<CardGroup cols={3}>
  <Card title="FastMCP" icon="bolt">
    High-level SDK for implementing the Model Context Protocol.
  </Card>

  <Card title="FastAPI" icon="server">
    Underlying ASGI framework handling HTTP and SSE connections.
  </Card>

  <Card title="SSE" icon="tower-broadcast">
    Server-Sent Events for streaming real-time responses to agents.
  </Card>

  <Card title="Stdio" icon="terminal">
    Standard Input/Output transport for local CLI-based agent integration.
  </Card>

  <Card title="Pydantic" icon="check-double">
    Strict schema validation for settings and tool arguments.
  </Card>

  <Card title="HTTPX" icon="globe">
    Async HTTP client for communicating with the main DataDot backend.
  </Card>
</CardGroup>

## Interaction Flow

The interaction between an Agent and the backend is mediated by the MCP server.

<Frame caption="MCP Interaction Flow">
  ```mermaid theme={null}
  sequenceDiagram
      participant Agent as AI Agent
      participant MCP as MCP Server
      participant Backend as DataDot App
      
      Agent->>MCP: Call Tool (query_content)
      MCP->>Backend: Validate API Key (X-Integrity)
      Backend-->>MCP: Auth Success + Context
      MCP->>Backend: Forward Request (Search)
      Backend-->>MCP: Stream Results
      MCP-->>Agent: Return Tool Result
  ```
</Frame>

## Authentication

Security is a primary concern. The MCP server acts as a proxy that validates credentials before allowing access to private data.

### 1. API Key Validation

Incoming tool requests must include an `X-API-Key` (or be pre-configured with `APP_API_KEY`).

1. The MCP server intercepts the request.
2. It calls `POST {BACKEND_URL}/api/v1/system/validate-api-key`.
3. The backend verifies if the key is valid and which Workspace it belongs to.

### 2. Workspace Context

After successful validation, the backend returns a **Workspace Slug** or ID. This context is injected into the tool execution, ensuring that the agent only accesses data it is authorized to see.