RailCall MCP · Model Context Protocol

AI proposes. Human governs.
Same airlock, same receipts.

RailCall exposes its airlock to any Model Context Protocol client — Claude Desktop, Cursor, Zed, custom agents. An AI can list your workflows, trigger runs, watch the queue drain. It cannot approve or execute — the human still clicks in Studio's Sends UI. Every send leaves the same Ed25519-signed receipt as if a human had fired it.

cannot approvecannot executeevery call loggedreceipts unchangedloopback + stdio transports
Install the stationWire it into Claude Desktop
The loop

AI drives. Human still gates every write.

Every MCP tool call this server exposes goes through the same airlock as a human click. AI can propose 100 sends; nothing lands until a human approves each one.

01
AI composes
Claude Desktop (or any MCP client) calls railcall_workflow_compose with an English description. Studio's compose LLM writes a typed spec bound to real airlock commands.
02
AI triggers
A follow-up railcall_workflow_run call fires the workflow over a data fixture. Each row that routes to a bound step lands as a pending airlock preview.
03
Human approves
In Studio's Sends UI, the pendings appear grouped by workflow_run. The human reviews per-row payloads. Preview → Approve → Execute for each. AI cannot participate here.
04
Signed receipt
Every executed send leaves an Ed25519-signed receipt. railcall_receipts_list lets the AI confirm what actually happened. Auditor can re-verify from the receipt alone.
The tool surface

Six tools. Zero of them bypass the airlock.

Every MCP tool is intentionally read or trigger-only. There is no approve tool. There is no execute tool. Both exist as HTTP endpoints on the local studio — but they're deliberately not surfaced through MCP. That's the trust boundary.

railcall_workflow_list
read
Enumerate every workflow the human has built in Studio. Returns name, title, bound-command list, verdict — everything the AI needs to pick which one to run.
railcall_workflow_run
trigger
Trigger a workflow over a data fixture. Each row that routes to a bound-command step materializes as a pending airlock preview. NOTHING FIRES — the human still approves in Studio.
railcall_workflow_compose
compose
Ask Studio's compose LLM to write a new workflow spec from an English description. Returns the typed spec so the AI can inspect it before asking a human to persist it.
railcall_pending_list
read
Snapshot of the airlock queue — what's waiting, which workflow_run each item came from, per-payload inputs. AI can poll this to watch the human's approval progress.
railcall_receipts_list
read
Signed receipts for every action taken. Include integrity_root + Ed25519 signature — verifiable byte-for-byte from any auditor.
railcall_receipt_verify
read
Independent auditor recomputes the integrity_hash and re-verifies the signature against the install's public key. No fake green.
Trust boundary

What the AI cannot do.

The six guarantees below are structural — enforced at the MCP tool surface, the airlock endpoint, the receipt signing layer. Not defaults an operator can forget to configure.

AI cannot approve
No MCP tool exposes /api/commands/approve. Even the most autonomous agent cannot bypass the human decision at the airlock. The trust boundary is enforced at the tool surface, not just the UI.
AI cannot execute
No MCP tool exposes /api/commands/execute either. A workflow run creates airlock previews; every actual write happens through a human click in Studio Sends.
Every proposal is logged
Every MCP tool call lands in the audit chain. If an AI agent proposes 1,000 sends and the human approves 3, the ledger shows exactly what was proposed, what was refused, what shipped.
Payloads are hashed
The AI cannot tamper with a payload between proposal and execution. Approve binds to a specific payload_hash; any drift refuses. An LLM that flip-flops on inputs cannot slip a modified payload past a stale approval.
Approvals are single-use
One human decision = one attempt. Even the AI cannot replay a captured approval — the airlock consumes it on the first execute try, success or failure.
Signed by your machine
Every receipt is Ed25519-signed by the install's private key, which never leaves your machine. An auditor verifies against the paired public key — no remote party can forge outcomes.
Two steps

Install the station, then point your MCP client at it.

1. Install RailCall
curl -fsSL https://railcall.ai/install.sh | bash

Installs the CLI, the Studio bundle, and the MCP server at ~/.railcall/station/workbench/mcp_server.py. No root, no phone-home.

2. Wire into Claude Desktop

Edit ~/Library/Application Support/Claude/claude_desktop_config.json:

{
  "mcpServers": {
    "railcall": {
      "command": "python3",
      "args": [
        "~/.railcall/station/workbench/mcp_server.py"
      ]
    }
  }
}

Restart Claude Desktop. The six railcall_* tools appear in the tool picker. Ask Claude "list my RailCall workflows" — you'll see it call railcall_workflow_list.

Other MCP clients

Cursor, Zed, and any custom agent that speaks MCP work the same way. Point the client at ~/.railcall/station/workbench/mcp_server.py with a stdio transport. The tool schemas expose over tools/list; every call through tools/call lands in the audit chain.

Let your AI do more. Prove every send.

Install RailCall on your machine. Wire the MCP server into your AI client. Every action from any agent goes through the same signed airlock as if you'd typed it yourself.

Install the stationRead the airlock docs