API overview
tRPC studio API, Better Auth, and MCP tools sharing one action layer.
tRPC (studio)
The dashboard (apps/web) mounts a tRPC router at /api/trpc. Procedures live in @loftlancer/api and enforce permissions via requireAction and organization/project membership.
Typical clients use React Query integration in apps/web — there is no separate public REST CRUD surface for product data in v1.
Authentication
Sessions use Better Auth with GitHub OAuth. Browser clients call /api/auth/* on the app origin (migrating to apps/auth for SSO).
Header Sign in links use buildSignInUrl() from @loftlancer/ui/auth-links with NEXT_PUBLIC_AUTH_URL.
MCP
apps/mcp exposes JSON-RPC MCP over HTTP. Tools are registered in @loftlancer/mcp and execute through runMcpTool → executeMcpAction in @loftlancer/api/mcp.
See the tool index for per-tool inputs, scopes, and examples.
Operator console
platform.* actions and apps/console are reserved for future platform admin work and are not part of the MCP product surface.