API, MCP & audit log
Ferrum is scriptable from the ground up: everything the UI does goes through the same REST API, and that same tool catalog is exposed over MCP for agents. Both are off by default.
Generating an API key
Any user can create a long-lived key from Profile > API Keys, scoped to one of two things:
- REST API: for third-party integrations and scripts, sent as
Authorization: Bearer <key>against/api/v1/.... - MCP only: for Claude Code, Claude Desktop, or any other MCP-capable agent. Profile > MCP integration has a ready-to-paste config for the common clients.
A key only works if an admin has switched the corresponding surface on first.
Turning the surfaces on
Under Settings > API & MCP, an admin enables the REST API and/or the MCP endpoint, and sets a cap on how many tool calls the AI Assistant's agent loop can make in a single message, a guardrail against a runaway chain of actions from one prompt.
Calling the REST API
curl https://ferrum.example.com/api/v1/connections \
-H "Authorization: Bearer <your-api-key>"Every route the UI itself calls is available the same way (connections, inventory, guests, backups, alerts, and so on) under /api/v1.
Connecting an MCP agent
Point an MCP-capable client at /mcp with an MCP-scoped key, using the config Profile > MCP integration generates for you. Once connected, the agent sees the same tool catalog the built-in AI Assistant uses: reading inventory and status is always available; anything that changes state respects the per-message tool-call cap from Settings > API & MCP.
Audit log
Every mutating action is recorded with who did it, what it was, and when, whether it came through the UI, the REST API, or MCP. Admins can review the full history under Audit Log, which makes "an agent did this at 2am" as traceable as a person clicking a button.