HAIEC Assurance API & MCP

A bounded Streamable HTTP MCP interface over canonical HAIEC services. Use it when an AI agent should discover setup, run Assurance, retrieve evidence-bound results, guide resolution, or perform explicitly approved supported actions.

Endpoint: https://www.haiec.com/api/mcp

// Cursor: .cursor/mcp.json  (or Devin: .devin/mcp_config.json)
{
  "mcpServers": {
    "haiec": {
      "url": "https://www.haiec.com/api/mcp",
      "headers": { "Authorization": "Bearer ${env:HAIEC_API_KEY}" }
    }
  }
}

Current MCP workflow:

ASK → PREFLIGHT → RUN → UNDERSTAND → RESOLVE → RE-EVALUATE → ESTABLISH

Re-running the same source analysis does not close a gap that requires policy, IAM, deployment, identity, telemetry, or other external evidence. The agent should follow the deterministic resolution category returned by HAIEC.

Then ask your agent:

• "Check whether HAIEC is ready to run — what setup am I missing?"
• "Run HAIEC Assurance."
• "What did HAIEC establish? What remains unknown?"
• "What evidence is missing?"
• "Explain the highest-consequence action paths."
• "Use these logs as evidence — with my approval — and rerun HAIEC."
• "What would resolve the open verification items?"
• "This test endpoint is mine — run a runtime safety preflight."
• "Start a HAIEC investigation" / "this is my first evidence" / "start collecting the next state."
• "Continue my HAIEC investigation" — the agent rediscovers the persisted investigation; no IDs to remember.
• "What changed?" / "Where does the proof stop?"

Investigations are persisted evidence timelines over user-declared states. The agent translates ordinary language into the explicit scenario binding, lists prior investigations on return (haiec_list_investigations), prepares scenario-bound live capture, and selects typed intake profiles (kpi, alarm, api_transaction, telecom profiles) that reuse the same canonical mappers as the REST intake routes. An investigation records received evidence — it is not an Assurance disposition.

MCP can perform supported AI System and source setup actions after explicit user approval. Third-party authorization such as GitHub App installation may still require a browser handoff. HAIEC never treats a caller-supplied repository URL or token as proof of trusted source authority.

Runtime testing is optional. HAIEC first performs a read-only runtime safety preflight. Execution requires explicit user authorization and confirmation, and unsupported or unproven-safe categories remain HELD.

Evidence ingestion stores qualified input for later Evaluation. An ingestion receipt does not mean an Assurance gap has been resolved.

Every MCP tool delegates to the canonical Assurance API boundary — same organization scope, same key scopes, same rate limits. MCP never accepts GitHub tokens or organization overrides. See Agent Integration.