# Connect any MCP agent to answers your team has certified

> Connect Claude Code or any MCP client to Sembric: eight read-only tools, revocable keys or OIDC tokens, typed filters and time grains, every call audited.

Canonical URL: https://sembric.app.arelis.digital/agents

Agents and MCP

Sembric runs a stateless HTTP MCP server and a typed REST API. Every call is limited to the certified products, governed views and ontology entries granted to the caller’s current role.

Tools

## Eight read-only tools

Agents discover what they may use, read its definition, then query it. There is no tool that accepts SQL.

Sembric MCP tools
| Tool | Purpose |
| --- | --- |
| `sembric_list_products` | List the certified aggregate data products granted to the caller’s role. |
| `sembric_describe_product` | Read a product’s definition, caveats, declared dimensions and their types. |
| `sembric_query_product` | Query a product by up to three declared dimensions, typed filters and a bounded limit. |
| `sembric_list_views` | List the certified governed views granted to the caller’s role. |
| `sembric_describe_view` | Read a view’s approved columns, fixed restrictions and caveats. |
| `sembric_query_view` | Read approved columns with typed filters; fixed row restrictions always apply. |
| `sembric_list_concepts` | List business concepts grounded by surfaces the caller can see. |
| `sembric_get_ontology` | Read typed relationships between those concepts. |

Credentials

## Two ways for an agent to authenticate

Direct clients

### Sembric API keys

-   Created on the Agents page for a member with the intended role; one-, seven- or 30-day lifetimes, one day by default.
-   Shown once, stored as a digest, revocable immediately.
-   Inherit the member’s current role, so a role change applies to their agents on the next call.

User-linked

### OIDC access tokens

-   Signed JWTs from your configured issuer, with audience equal to Sembric’s /mcp resource and the sembric:read scope.
-   Must carry a verified email that matches exactly one current workspace member.
-   Sembric publishes protected-resource metadata so OAuth-aware clients can discover the requirement.

Connect

## Verify the endpoint, then add it to your agent

Use a short-lived key and a public HTTPS Sembric endpoint. The tool list returns only what the key’s member may see.

List tools with curl

```
curl -fsS "$SEMBRIC_URL/mcp" \
  -H "Authorization: Bearer $SEMBRIC_AGENT_KEY" \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}'
```

Claude Messages API MCP connector

```
{
  "mcp_servers": [{
    "type": "url",
    "url": "https://your-sembric.example.com/mcp",
    "name": "sembric",
    "authorization_token": "YOUR_SEMBRIC_AGENT_KEY"
  }],
  "tools": [{ "type": "mcp_toolset", "mcp_server_name": "sembric" }]
}
```

Claude Code and other HTTP MCP clients connect to the same `/mcp` endpoint with the key as a bearer token. ChatGPT’s custom MCP connection requires the user-linked OAuth path.

Asking richer questions

## Grouping, time grains and typed filters

sembric\_query\_product groups by up to three declared dimensions. Date and timestamp dimensions accept day, week, month, quarter or year grains; send integers and decimals as strings and dates as YYYY-MM-DD.

Arguments for sembric\_query\_product

```
{
  "productId": "…",
  "dimensions": ["ordered_at:quarter", "region"],
  "filters": {
    "region": { "in": ["North", "East"] },
    "ordered_at": { "gte": "2026-01-01T00:00:00", "lt": "2027-01-01T00:00:00" }
  },
  "limit": 20
}
```

### Two deliberate refusals

-   A query matching more groups or rows than its limit is refused with narrowing guidance, never truncated.
-   Groups backed by fewer records than a product’s minimum are omitted, so an empty result can mean the group is too small to release.

Monitoring

## See what your agents attempted

Owners and engineers watch agent traffic over the last 24 hours, 7 days or 30 days.

-   Answered and refused calls, compared with the previous period, plus the products and views agents query most.
-   Recent refusals with the reason the agent received, and a live feed of the latest calls.
-   Every key with its holder, role, expiry and last use over MCP or REST.
-   Audit filters by channel, key, member and time.

FAQ

## Frequently asked questions

### Does Sembric work with Claude?

Yes. Claude Code and other MCP clients connect to Sembric’s HTTP MCP endpoint, and the Claude Messages API MCP connector can use the same endpoint with a short-lived key.

### What happens when we revoke a key?

The agent is refused on its next call. Sembric also rechecks membership, role, the calling credential and the certificate after each source query, so a revocation during a query withholds its result.

### Why would a query come back empty or refused?

A query matching more rows than its limit is refused with narrowing guidance rather than truncated, and a product’s minimum group size omits small groups. Undeclared fields, ungranted roles and uncertified surfaces are refused and audited.

## Give your agents their first certified surface

We’ll help you certify a product on your own warehouse and connect Claude Code or your own agent to it.

[Request a pilot](https://sembric.app.arelis.digital/contact) · [Email us](mailto:contact@arelis.digital?subject=Sembric%20pilot%20request)

---

Last updated 2026-10-14. Published by Arelis AI (https://arelis.digital).