Flottix

Deterministic IT asset registry AI agents operate over MCP - agents onboard, offboard and audit hardware and licenses; humans approve. OAuth 2.1, per-resource scopes, immutable audit trail. Free plan: 50 items, full agent access.

View on flottix.app

Hosted MCP Server

npx add-mcp 'https://flottix.app/api/mcp'

Installs into Claude Code, Codex, Cursor and more

Documentation

Flottix Agent Quickstart

Get an AI agent (Claude, Codex, Cursor, Antigravity, pi, Cline, Gemini CLI, any MCP client) operating your IT asset registry in under a minute.

1. Create an API key

In the dashboard (https://flottix.app): Agents (sidebar) → name your key → Create key. Default preset Read/Write grants every read:*, write:* and checkout:* scope — enough to operate the whole registry. Full Access adds the admin scope (bypasses all checks: user management, API keys, org settings).

The raw key (flottix_...) is shown once, with ready-to-paste configs.

Via REST instead:

curl -X POST https://flottix.app/api/v1/api-keys \
  -H "Authorization: Bearer <session>" -H "Content-Type: application/json" \
  -d '{"name": "my-agent", "scopes": ["read:assets", "write:assets"]}'

2. Connect your client

The MCP endpoint is native remote (Streamable HTTP) — no bridge, no extra process.

Cursor / VS Code / Cline / Antigravity (mcp.json):

{
  "mcpServers": {
    "flottix": {
      "url": "https://flottix.app/api/mcp",
      "headers": { "Authorization": "Bearer flottix_YOUR_KEY" }
    }
  }
}

Claude Code (one-liner):

claude mcp add --transport http flottix https://flottix.app/api/mcp \
  --header "Authorization: Bearer flottix_YOUR_KEY"

Any client — plain MCP over HTTP with the same URL + Authorization header. Prefer short-lived tokens? Exchange the key via OAuth 2.1 client credentials:

curl -X POST https://flottix.app/api/v1/oauth/token \
  -d grant_type=client_credentials \
  -u "flottix_YOUR_KEY:" \
  -d scope="read:assets"

Agents acting for a human (Claude Desktop connectors, Smithery, per-user consent) — OAuth 2.1 authorization code + PKCE:

  1. GET /.well-known/oauth-authorization-server (RFC 8414) — endpoints, scopes, PKCE methods.
  2. POST https://flottix.app/api/v1/oauth/register (RFC 7591) — open, instant client registration; public clients authenticate with PKCE only.
  3. GET https://flottix.app/api/v1/oauth/authorize — the user approves in the browser (consent screen, optional "remember this app").
  4. POST https://flottix.app/api/v1/oauth/token with grant_type=authorization_code → 1-hour access token + 30-day rotating refresh token (reuse detection). POST https://flottix.app/api/v1/oauth/revoke (RFC 7009) tears the grant down.

3. First commands to try

  • "List all MacBooks checked out, grouped by department."
  • "Jane Doe is leaving — offboard her: check in hardware, reclaim licenses. Show me the impact first."
  • "Audit for zombie assets and unused license seats; quantify the monthly waste."
  • "Here's a Dell packing slip: — ingest it and stage the laptops."

Every mutating tool is two-phase: the first call returns an impact manifest, nothing is written until you confirm. Every call is scoped, logged and auditable.

Reference