The primary agent is Claude Code: it works with AxonWeaver, Axon Risk and the analytics center through their MCP servers, and any other MCP client will do as well. There is no language model inside the servers: the agent decides what to call, the server performs the step deterministically and answers in a way that lets the agent fix its own mistakes.
The same rules hold on the AxonWeaver and Axon Risk servers. They are written in the code and in the skills the agent loads for each workspace.
The agent chooses the sequence of calls. The server performs each step deterministically and returns a structured answer. There is no model inside the server and nothing is decided at its discretion.
A tool never writes SQL itself: it calls the same service as REST and the interface. So a tool's answer never disagrees with what the operator sees on screen.
Every call carries the id of the session the operator opened on the object's page. A write is accepted only in a session bound to what is being changed, and the object's keys come from that binding, not from the agent's arguments.
A refusal is an ordinary answer with the reason, the allowed values and a hint of what to do next. After a write comes a validation report, and the agent corrects itself with the next call.
Promoting a strategy version to production and changing statuses in Axon Risk are buttons in the interface; MCP has no such tools. In AxonWeaver the operator confirms writing calls, and a delete only shows its impact by default.
A tool's answer goes into the model's context, so it never holds secret values: only the names of headers and variables. A live call to an external system from a run happens only with an explicit flag.
A session is the unit of authorisation and audit. It lives on the server, not in the transport, so a client reconnect or a server deploy does not break it.
A session from opening to a person's decision: operator, agent, server
The operator opens a session on a workspace page. It is bound to an object: a project, a task, a draft strategy version, a data source.
The operator gives the session id to their agent. From it the agent learns the workspace and loads its skill: the order of work, the contracts, the usual mistakes.
Every call, with its arguments, duration and outcome, lands in the panel next to the object. A writing tool checks the changes and answers with a report: what was applied, what was refused and why. Rate limits apply per session and per token.
The agent prepares a draft and a report. The operator takes the irreversible step personally, in the interface, seeing everything the agent did in the session.
Each product has its own MCP server. The server itself tells the agent which workspaces it has and which skill to load for each.
Business processes, external APIs, the UI backend for FlutterFlow, connected systems and business developer tasks. One server and five workspaces, each with its own skill. The project comes from the session, so another project cannot be addressed by mistake.
Credit strategies: data sources and their mocks, the graph of a draft strategy version, Python procedures, test datasets and regression. More than forty tools in five workspaces. Code the agent writes is checked and run in a separate process before it is stored.
SQL over the analytical warehouse, charts, dashboards and dataset schemas. The agent builds a report with the same tool the analyst uses.
Instance status, assets, jobs and schedules, launching jobs and refreshing marts. The marts are built from Axon Risk strategy logs and the AxonWeaver registry.
Hybrid search with a reranker over the registry, strategies and documentation, answers with sources. The business developer's agent searches it straight from the task tools.
The app's screens, actions and endpoints change through FlutterFlow's own MCP server. AxonWeaver does not replace it; it registers and reconciles what was created there.
The Workbench issues the agent's session: a Keycloak token for the user's role, with a limited lifetime. The MCP servers check the signature, the issuer and the audience, and a call to a tool the role does not allow gets 403 before it runs.
Read-only tools only: lists, schemas, statuses, chart data.
Plus SQL, charts and dashboards in Superset and launching jobs in Dagster.
Every tool of both servers.
An example on real tools: one task, two products. Every call is visible to the operator in the session panel.
The scenario's steps by product: Axon Risk, the analytics center and a person
The agent copies the working strategy version into a draft. From now on, edits touch only the draft.
Changes to nodes and thresholds go in one batch. The server fills in the version key from the session, and a graph validation report comes back after the write.
The draft runs on input data through the same engine as production, with source mocks, and stores nothing. A live HTTP call to a source needs explicit permission.
Executions the working version recorded over a period are replayed on the candidate from the recorded source answers, with no new calls. The report shows, row by row, where the decision changed.
The agent refreshes the strategy log mart in Dagster and builds a chart for the strategy in Superset that the analyst will see too.
The operator reviews the reports and promotes the version to production personally, with a button in the Axon Risk interface. The agent has no such tool.
The servers speak Streamable HTTP with a token in the header. The deployment's administrator issues addresses and tokens; the operator gives the agent only a session id.
{
"mcpServers": {
"axonweaver": {
"type": "http",
"url": "https://<AXONWEAVER_MCP_URL>",
"headers": {"Authorization": "Bearer <TOKEN>"}
},
"axon-risk": {
"type": "http",
"url": "https://<AXON_RISK_MCP_URL>",
"headers": {"Authorization": "Bearer <TOKEN>"}
},
"superset": {
"type": "http",
"url": "https://<SUPERSET_MCP_URL>",
"headers": {"Authorization": "Bearer <SESSION_TOKEN>"}
}
}
}The shape of the configuration, with placeholders instead of addresses and tokens. Any client that speaks MCP over HTTP will do.
Demo access, an architecture walkthrough and a timeline estimate for your domain.