Flottix

Deterministic IT asset registry AI agents operate over MCP - agents onboard, offboard and audit hardware and licenses; humans approve. OAuth 2.1, per-resource scopes, immutable audit trail. Free plan: 50 items, full agent access.

Ver en flottix.app

Servidor MCP alojado

npx add-mcp 'https://flottix.app/api/mcp'

Se instala en Claude Code, Codex, Cursor y más

Documentación

Flottix Agent Quickstart

Get an AI agent (Claude, Codex, Cursor, Antigravity, pi, Cline, Gemini CLI, any MCP client) operating your IT asset registry in under a minute.

1. Create an API key

In the dashboard (https://flottix.app): Agents (sidebar) → name your key → Create key. Default preset Read/Write grants every read:*, write:* and checkout:* scope — enough to operate the whole registry. Full Access adds the admin scope (bypasses all checks: user management, API keys, org settings).

The raw key (flottix_...) is shown once, with ready-to-paste configs.

Via REST instead:

curl -X POST https://flottix.app/api/v1/api-keys \
  -H "Authorization: Bearer <session>" -H "Content-Type: application/json" \
  -d '{"name": "my-agent", "scopes": ["read:assets", "write:assets"]}'

2. Connect your client

The MCP endpoint is native remote (Streamable HTTP) — no bridge, no extra process.

Cursor / VS Code / Cline / Antigravity (mcp.json):

{
  "mcpServers": {
    "flottix": {
      "url": "https://flottix.app/api/mcp",
      "headers": { "Authorization": "Bearer flottix_YOUR_KEY" }
    }
  }
}

Claude Code (one-liner):

claude mcp add --transport http flottix https://flottix.app/api/mcp \
  --header "Authorization: Bearer flottix_YOUR_KEY"

Any client — plain MCP over HTTP with the same URL + Authorization header. Prefer short-lived tokens? Exchange the key via OAuth 2.1 client credentials:

curl -X POST https://flottix.app/api/v1/oauth/token \
  -d grant_type=client_credentials \
  -u "flottix_YOUR_KEY:" \
  -d scope="read:assets"

Agents acting for a human (Claude Desktop connectors, Smithery, per-user consent) — OAuth 2.1 authorization code + PKCE:

  1. GET /.well-known/oauth-authorization-server (RFC 8414) — endpoints, scopes, PKCE methods.
  2. POST https://flottix.app/api/v1/oauth/register (RFC 7591) — open, instant client registration; public clients authenticate with PKCE only.
  3. GET https://flottix.app/api/v1/oauth/authorize — the user approves in the browser (consent screen, optional "remember this app").
  4. POST https://flottix.app/api/v1/oauth/token with grant_type=authorization_code → 1-hour access token + 30-day rotating refresh token (reuse detection). POST https://flottix.app/api/v1/oauth/revoke (RFC 7009) tears the grant down.

3. First commands to try

  • "List all MacBooks checked out, grouped by department."
  • "Jane Doe is leaving — offboard her: check in hardware, reclaim licenses. Show me the impact first."
  • "Audit for zombie assets and unused license seats; quantify the monthly waste."
  • "Here's a Dell packing slip: — ingest it and stage the laptops."

Every mutating tool is two-phase: the first call returns an impact manifest, nothing is written until you confirm. Every call is scoped, logged and auditable.

Reference