Xorventa MCP

The Xorventa Connector lets you connect an AI assistant you already use to your own Xorventa account. From that assistant you can ask Xora, Xorventa’s account assistant, about your business and your account, see what is waiting for your decision, and ask for supported work to be done — posting, replying, sending, changing settings and deleting — within the permissions you choose.

It uses the open Model Context Protocol (MCP). The address is https://api.xorventa.ai/mcp. It is included with every Xorventa account at no extra charge.

It works through the same list of actions Xora uses on your account pages, under the same switches, with a few things left out that are listed further down this page. A connected assistant cannot do anything Xora is not allowed to do for you.

• Before you start: you need a Xorventa account you can sign in to, and an assistant that lets you add a custom connector. The setting is usually called connectors, integrations or tools.
• Add the address. In your assistant, add a new connector and enter https://api.xorventa.ai/mcp.
• Sign in to Xorventa. Your assistant opens a Xorventa page; sign in to your own account. The request lasts 10 minutes — if it lapses, start again from your assistant.
• Review the approval screen. It shows the assistant’s name and web address, the Xorventa account it will connect to, and each permission it is asking for, all ticked to start with. Untick any you do not want to grant; reading cannot be unticked. Then approve or decline.
• Ask something. Go back to your assistant and ask, for example, “What needs my attention in my Xorventa account today?”
• Nothing is connected until you approve. Declining tells the assistant you said no, and nothing is shared. Your assistant may also show its own permission prompts, for example before it uses a tool; those come from your assistant, not from Xorventa.

Each permission is listed as it appears on the approval screen, with the short name your Profile Settings page shows for it. No permission includes another.

• Read your account (xorventa:read) — required — See your Xorventa products, settings, setup steps and activity, and ask Xora questions about your business.
• Change settings (xorventa:manage) — Change settings for you, where you have allowed Xora to change settings.
• Publish, send or delete directly (xorventa:execute) — Publish posts and replies, send email, and delete things for you, without asking each time — within the switches you set on the What Xora knows about you page.
• Draft for your approval (xorventa:prepare) — Draft posts, replies and other things to publish; they wait for you to confirm in Xorventa. Grant this without “Publish, send or delete directly” if you want to approve each one.

• Read only: the assistant can look and ask, and changes nothing.
• With Change settings: it can change the settings Xora is allowed to change.
• With Publish, send or delete directly: publishing, sending and deleting run as soon as the assistant asks, if your switch for that kind of action is on.
• With Draft for your approval but not Publish, send or delete directly: every publish, send or delete becomes a proposal that waits for you (see Proposals below).
• Some settings count as publishing when they are used a certain way. Switching social replies to automatic, for example, is treated as publishing.
• To change what a connection may do, disconnect it, connect again, and tick the permissions you want this time.

A permission lets the assistant ask. It does not replace any of your account’s own rules. Every request is checked against:

• the permissions you granted to this connection;
• your switches on the What Xora knows about you page;
• the products your account includes;
• the services you have connected, such as a social network, mailbox or website;
• your account’s usage limits; and
• your account boundary: a connection belongs to one Xorventa account and cannot reach any other.
• Your switches and the connection are checked again at the moment an action runs. If you switch something off or disconnect the assistant, the next action stops.
• Everything a connected assistant asks for, including anything that was refused, is listed with what Xora did on your What Xora knows about you page, marked as coming from that assistant.

Each tool is listed by the exact name your assistant sees, followed by its title and what it is for. You do not call these yourself; your assistant chooses them from what you ask. Actions are split by what they do — reading, changing settings, publishing or sending, and deleting — and each of those four tools refuses an action of another kind. In ChatGPT and Codex the same actions appear as one tool each.

• xorventa_status · Account status — Your products, unfinished setup steps, what is waiting for your decision, and links to the right pages in your account. Reads only. Needs Read.
• xora_ask · Ask Xora — Ask Xora a question about your account or about Xorventa. Her answer draws on Xorventa’s help material, your approved Business Facts, your open work items and what she remembers about you, and may name actions that would do what you asked. It changes no setting. The question and answer are kept as this connection’s conversation so the assistant can continue it. Needs Read.
• xora_capabilities · List actions — Every action Xora can take for your account and every action that stays with you, with what each one does, which permission it needs, whether it would run directly or as a proposal for this connection, and whether this connection can use it now — and if not, why not. Needs Read.
• xora_action_details · Action details — For one action: the information it needs, what it does, whether it runs directly or waits for you, and which page in your account it belongs to. Runs nothing. Needs Read.
• xora_read · Read account data — Runs one read: lists, look-ups and summaries of your chat windows, Business Facts, settings, drafts, posts, SEO audits and activity. Refuses anything that changes something. Needs Read.
• xora_change_settings · Change settings — Runs one settings change: chat window look and wording, Business Facts, knowledge sources, assistant, phone, mailbox and SEO settings, drafts that are not published, and similar changes inside your account. Needs Change settings; the few settings that always ask first also need Publish, send or delete directly, or become a proposal with Draft for your approval.
• xora_publish_or_send · Publish or send — Runs one publishing or sending action: social posts and replies, email replies, appointment changes that notify the person who booked, and website changes that go live. Runs directly with Publish, send or delete directly; becomes a proposal with Draft for your approval.
• xora_delete · Delete — Runs one delete: drafts, records, knowledge sources, reports, connections and published posts. Runs directly with Publish, send or delete directly; becomes a proposal with Draft for your approval.
• xora_action_status · Action status — The current state of an action this connection asked for. It never runs, retries or changes the action. Needs Read.
• xora_cancel_action · Cancel an action — Cancels a proposed or waiting action this connection asked for, as long as nothing has been handed to another service yet. Needs Draft for your approval or Publish, send or delete directly.
• xora_upload_prepare · Prepare an upload — Reserves a one-time upload for an action that uses a file (see Files and uploads). Needs Change settings.
• xora_upload_status · Upload status — Whether a prepared file arrived and passed its checks, so it can be used. Needs Read.
• xora_upload_from_url · Attach a file from a web address — Xorventa fetches a file from a public https web address and stages it for an action that uses a file, after the same checks an upload meets (see Files and uploads). Needs Change settings.
• xora_upload_request · Ask the owner for a file — Shows you a card in the chat where you choose a file from your device; it is uploaded and checked, and the assistant then uses it — for example, puts it on a post. Needs Change settings.

• Each request carries an identifier chosen by your assistant. If it sends the same request again with the same identifier, Xorventa returns the first result and does not do the work twice.
• A request comes back as done, proposed (waiting for you), queued or running (not finished yet), failed, refused (with the reason), cancelled, or indeterminate. Only done means it happened.

If you granted Draft for your approval but not Publish, send or delete directly, anything that would publish, send or delete is prepared but not done:

• The assistant receives a proposal and a link to a confirmation page in your Xorventa account.
• You open the link, signed in to Xorventa, and see exactly what will run and where. Confirm it or choose Not now.
• You have 10 minutes to confirm. After that the proposal expires and nothing happens; your assistant can prepare it again if you still want it.
• Once you confirm, the action runs, and the assistant can check its status.
• Your assistant cannot confirm a proposal for you. If you disconnected the assistant or switched that kind of action off in the meantime, confirming is refused and nothing runs.

• Your assistant can cancel a proposed or waiting action it asked for, before it has been handed to another service. Cancelling cannot undo work that has already happened.
• If an action that publishes, sends, deletes or changes something times out, or fails on the other service’s side after it has started, Xorventa reports it as indeterminate and does not try again: it may already have happened. Check the page in your Xorventa account, or the network or service itself, before asking for it again. This prevents duplicate posts and messages.

Some actions use a file: an image or video for a social post, a business logo or banner, a chat window image, or a document for your Business Facts. A remote assistant cannot read the files on your computer, so it gives Xorventa the file in one of these ways:

• Social post media — PNG, JPEG, GIF or WebP images, or video — up to 100 MB (a short phone video fits). A file sent inside the request itself is limited to 8 MB.
• Business logo or banner; chat window image — PNG, JPEG, GIF or WebP images — up to 10 MB.
• Business Facts document — PDF, Word (.docx or .doc), plain text, Markdown, HTML or CSV — up to 10 MB.
• Waiting to be used — At most 20 staged files, or 200 MB, per account at a time. A staged file is held for no more than an hour and then deleted. The product it is added to may apply its own further checks.

• In the same request, for a social post. When the assistant uploads social media, creates a post or edits a draft or scheduled post, it can include the image or video itself — by its public https web address, or the file’s contents (up to 8 MB). Xorventa stores it and puts it on the post in one step.
• By web address. Xorventa fetches a public https address the assistant names and stages the file for the action. Private and local addresses, plain http, and any redirect to one are refused.
• In the chat. The assistant shows you a card where you choose a file from your device; it is uploaded and checked, and the assistant then uses it — for example, puts it on a post.
• By upload link. The assistant declares the file — its name, type, size, a fingerprint of its contents (SHA-256) and the one action it is for — and sends the exact file to the one-time link Xorventa returns. The link works once, for 10 minutes, and carries its own credential, so it also works from an assistant’s code tools. A file that does not match its declaration is rejected.
• Or the assistant gives you a link to a Xorventa page where you choose the file yourself.
• However a file arrives, it meets the same type and size checks, and its type is read from the file itself, not from its name or the website that served it. A staged file can be used by one action only, within 10 minutes. Xorventa never reads a file path an assistant names.
• Each web address Xorventa fetches is listed with what Xora did on your What Xora knows about you page, by the website’s name.

Configuration and money stay with you. These actions are marked as staying with you, and the assistant is told which page in your account to send you to. A connected assistant cannot:

• change your password, account email, two-factor settings or recovery codes;
• add, change or choose a payment card;
• buy anything, change a plan, or cancel a product;
• publish a chat window;
• start the free SEO review, or turn on automatic website changes;
• clone a voice;
• connect or sign in to a social network, mailbox, Google, Bing or a website platform on your behalf;
• delete your Xorventa account;
• turn on Xora’s switches, grant itself more permissions, or act outside the permissions you gave it;
• confirm its own proposals; or
• control a live phone call.

An assistant you allow to read your account can discuss your plan and what a change would cost, including quotes, plan-change previews and promotion codes — buying and changing a plan stay with you. It can read each of your products’ own lists, with what is in them, so it can act on them: your social comments, messages and mentions and who wrote them; your SEO drafts, next actions, reports, content gaps and Search Console and Google Analytics figures; the customer questions Xora could not answer; your appointments, including the names and email addresses of the people who booked; and the emails waiting for your approval, with the reply drafted for each. In ChatGPT and Codex, email addresses and phone numbers in those lists are masked (for example j•••@example.com, •••-4821), the full sender comes when you ask to read one email, and no billing email, card details or meeting links are returned.

• Your private conversations with Xora on your account pages. (Xora’s answers to it can draw on what she remembers about you and on your open work items, as they do on your account pages.)
• Your password, two-factor settings or recovery codes, and the sign-in credentials of the networks and services you have connected.
• What a connected assistant does receive is handled by the company that provides it, under that company’s own terms and privacy policy. See the Xorventa Privacy Policy, section 6, Connected AI Assistants.

• Sign-in: the assistant’s access credential lasts 15 minutes and is renewed with a refresh credential that lasts 30 days and is replaced each time it is used. We store only a one-way hash of each credential.
• Conversation with Xora: the last eight questions and answers for each connection, encrypted, so the assistant can continue the conversation. It stops being used 24 hours after the last question, and is erased at once when you disconnect the assistant.
• A daily clean-up deletes: expired connection requests, sign-in codes and access credentials an hour after they expire; refresh credentials an hour after they expire, or 30 days after they were replaced or cancelled; unused staged uploads an hour after they expire, and used ones 24 hours after use; expired Xora conversations an hour after they expire; a disconnected assistant’s remaining credentials and uploads 30 days after you disconnect it; and each finished action’s Connector record, including its encrypted result, after 90 days.
• Kept with your account: the entry for each action in what Xora did on your What Xora knows about you page, like every other Xora action, and the record of each connection — the assistant’s name and web address, the permissions you granted, and when it was connected, last used and disconnected.

• In Xorventa: open Profile Settings and find Connected AI assistants. Each connection shows the assistant’s name, its permissions, when it was connected and when it was last used. Choose Revoke, then Yes, disconnect.
• It takes effect immediately. Every credential the assistant holds stops working, requests it made that have not yet been handed to another service are cancelled, and its Xora conversation is erased. Work already handed to another service before you disconnected cannot be recalled this way.
• In your assistant: you can also remove the connector from your assistant’s settings. That stops the assistant calling Xorventa; disconnecting in Xorventa is what ends the access on our side.
• To connect again later, add the connector again and approve its permissions again. If you delete your Xorventa account, every connected assistant is disconnected at once.

What your assistant reports, what it means, and what to do.

• “Connect this assistant to a Xorventa account first.” or a request to sign in again — The connection is not signed in: its 30-day sign-in lapsed, or you disconnected it. Reconnect from your assistant and approve again.
• “This connection was not granted xorventa:…” — The action needs a permission you did not grant. If you want to allow it, disconnect, connect again and tick that permission.
• “The owner has not allowed this yet. On the What Xora knows about you page, they can turn on: …” — Your switch for that kind of action is off. Turn it on at What Xora knows about you if you want to allow it.
• “… stays with the owner.” — The action is one of the configuration-and-money actions above. Do it yourself on the page your assistant names.
• “This Xorventa account is asking Xora more than she can answer right now. Wait a minute, then try again.” — Your account has used its Xora answers for this minute (the limit is shared with Xora on your account pages). Wait a minute and ask again.
• “Xora is busy with other requests on this account — try again in a moment.” — Xora is already answering two questions for your account, from your assistant or your account pages. Ask again in a moment.
• “That was refused for now because of too many actions in a short time. Try again in a little while.” — Your account has asked for more than 40 actions in a minute, or more than 60 changes in 10 minutes. Wait, then ask again.
• An action refused as the wrong tool — The assistant sent the action to the tool for a different kind of action. Nothing ran; the assistant can send it to the right one.
• upload_quota_exceeded — Your account already has 20 staged files, or 200 MB, waiting to be used. Use the files already staged, or wait — unused files expire within an hour.
• upload_storage_full — Xorventa’s temporary file storage is full. Try again later; if it continues, contact support.
• too_large or type_not_allowed — The file is bigger than the limit for that action, or of a type it does not accept. See the limits under Files and uploads.
• size_mismatch, sha256_mismatch or content_not_… — The file sent does not match what was declared, or its contents are not the declared type. Prepare the upload again with the correct file details.
• “That upload was already used by another action, so nothing was done.” — Each upload can be used once. Stage the file again.
• An upload that has expired — The 10-minute upload link lapsed, or the connection was disconnected. Prepare a new upload.
• A proposal that expired — Nobody confirmed it in time (10 minutes). Ask your assistant to prepare it again if you still want it, and confirm it promptly.
• “The connection that asked for this was revoked, so nothing was done.” — You disconnected the assistant before the action started. Reconnect and ask again if you still want it.
• indeterminate — The action started but its outcome could not be confirmed; it may already have happened. Do not ask again until you have checked the page in your account or on the network.
• “Something went wrong on Xorventa’s side. Nothing was retried …” — A temporary problem on our side. Have the assistant check the action’s status first, then try again in a minute.
• The approval page says the request has expired, was already answered, or does not exist — The 10-minute connection request lapsed or was already used. Start connecting again from your assistant.

• Email support@xorventa.ai, or send us a message at https://xorventa.ai/contact.
• Tell us which assistant you use, roughly when the problem happened, and what the assistant reported. Never send us your password or a sign-in code.