How Do AI Coding Assistants Connect to an AI Workflow Platform?

MCP (Model Context Protocol) is an open standard published by Anthropic in 2024 and adopted by Claude Code, Claude Desktop, VS Code (GitHub Copilot), and JetBrains AI. It defines a standard interface for AI coding assistants to call external tools over a hosted HTTPS connection. The assistant sends a tool call to the MCP server, the server executes the action, and the result is returned to the assistant's context. No local software is installed on the developer's machine: the connection is outbound HTTPS to the platform's hosted MCP endpoint.

The practical effect for a developer using Claude Code: instead of opening a browser tab to check whether a workflow instance has completed, they ask Claude Code directly. Claude Code calls the relevant Dave by voolama MCP tool, receives the instance status, and returns it in the conversation. The developer never leaves the terminal.

Dave by voolama (hellodave.ai) exposes 34 MCP tools across four capability presets at DEV v0.11.0, confirmed against content_orchestrator main at commit ddb945f, 2026-08-30. The four AI assistants that connect today are Claude Code, Claude Desktop, VS Code (GitHub Copilot), and JetBrains AI. Connection is configured by generating a per-user MCP key at Admin, then API Management, then MCP and entering it in the assistant's MCP configuration. No additional software is required on the developer's machine.

What the 34 tools cover: the tools span workflow management (create, read, update, activate, archive workflow definitions and versions), agent management (create, read, update agent definitions and versions), instance management (launch, monitor, read instance context and status), and task management (read, complete, and submit decisions on Human Review and User Interaction tasks). The exact tool names within each preset are not listed in the public help documentation at DEV v0.11.0. Sourced from the feature-summary help documentation, DEV v0.11.0, confirmed 2026-08-30.

Commercial interest disclosure: this article is published by voolama LLC, the company that operates Dave by voolama. The MCP integration described here is a feature of that product. The two external frameworks cited in this article, OWASP LLM08 and NIST SP 800-53 Rev 5 AU-2, apply equally to any platform offering MCP or similar programmatic AI tool access, and are cited here because they are the authoritative independent sources for the risk and control principles described.

MCP access in Dave by voolama is controlled by two mechanisms that are independently enforced at the API layer, not just the UI layer: the capability preset assigned at key-generation time, and the user's role within the tenant.

Capability presets: when an Admin generates an MCP key for a user at Admin, then API Management, then MCP, they select one of four capability presets. The preset determines which of the 34 MCP tools the key unlocks. Narrower presets cover read-only or task-completion access. Broader presets cover workflow and agent management. The preset is set at key-generation time and cannot be changed without revoking and regenerating the key.

Known limitation at DEV v0.11.0: MCP keys are scoped to a preset, not to individual tools within a preset. A user who is granted an MCP key receives all tools in the assigned preset. There is no way to grant access to a subset of tools within a preset. This means the choice of preset is the only access-control lever available at key-generation time.

OWASP LLM08 (Excessive Agency), OWASP Top 10 for Large Language Model Applications: this control identifies over-permissioned AI tool access as a primary risk vector in LLM-integrated systems. The principle it establishes is that an AI agent or assistant should be granted the minimum set of tools and permissions needed to complete its intended function. Applied to MCP preset assignment: assign the narrowest preset that covers the user's actual workflow automation tasks. A developer who only needs to check instance status and complete tasks does not need a preset that includes workflow-creation or agent-configuration tools.

Role enforcement: MCP access does not bypass the tenant's role-based access control. A user whose tenant role does not grant workflows:write cannot create a workflow via MCP even if their MCP preset includes the workflow-creation tool. Dave by voolama enforces 20 permission types at both API and MCP level. A call that exceeds the user's role permissions returns a 403 error. Sourced from the getting-started help documentation, DEV v0.11.0, confirmed 2026-08-30.

Audit trail: every MCP action is recorded in the tenant audit log with the acting user's identity, the MCP tool called, and the timestamp. The audit log is at Admin, then Settings, then Audit Log. Access requires the Admin role (admin:*) or the audit:read permission. When SOC 2 or GDPR compliance mode is enabled, MCP actions on sensitive endpoints are also tagged with a complianceTriggered: true flag. Sourced from the audit-logs help documentation, DEV v0.11.0, confirmed 2026-08-30.

Giving an AI coding assistant programmatic access to a production workflow platform is a meaningful security decision. Three questions to answer before you generate the first MCP key, grounded in OWASP LLM08 and NIST SP 800-53 Rev 5:

1. Which preset does this user actually need? OWASP LLM08 (Excessive Agency, OWASP Top 10 for Large Language Model Applications) identifies over-permissioned AI tool access as a primary risk vector. A developer who only needs to check instance status and complete tasks does not need a preset that includes workflow-creation tools. Assign the narrowest preset that covers the user's actual tasks. The risk is proportional to the breadth of access granted.
2. What happens if the key is compromised? An MCP key in Dave by voolama is a bearer credential: anyone who holds it can call the tools in the assigned preset as the user who generated it. Rotate keys on the same schedule as other service credentials. Revoke keys immediately when a developer leaves the team. Revocation is at Admin, then API Management, then MCP: find the key and click Revoke. Revocation is immediate.
3. How will you audit MCP usage? NIST SP 800-53 Rev 5 control AU-2 (Event Logging) requires that organisations identify the types of events that the system is capable of logging in support of the audit function. MCP tool calls are a distinct category of event that should be explicitly included in that inventory. Every MCP action in Dave by voolama is in the audit log. If your tenant runs SOC 2 or GDPR compliance mode, MCP actions on sensitive endpoints are tagged with complianceTriggered: true. Set a review cadence for MCP-sourced audit events, particularly for presets that include write access to workflow definitions or agent configurations.

What MCP does not change: MCP access does not alter the platform's credential security model. API keys for AI providers are stored in the per-tenant vault encrypted with AES-256-GCM authenticated encryption and are never returned through the API or MCP after storage. An AI coding assistant with an MCP key cannot read a stored provider API key. Sourced from the feature-summary help documentation, DEV v0.11.0, confirmed 2026-08-30.

What this article does not cover: this article describes the MCP integration architecture in Dave by voolama and cites OWASP LLM08 and NIST SP 800-53 Rev 5 AU-2 as the independent frameworks that govern the risk and control principles described. It does not cover the MCP protocol specification in detail, does not assess the security posture of any specific AI coding assistant, and does not constitute security advice for any specific deployment.