Assistant over MCP, and the API underneath

Why this is cheap here

The whole product is one flat REST surface over everything — guests, networks, firewall, storage, labs, backups. There is no separate management appliance, no second API for the guests and no directory service in between. Handing that to a model is a day's work.

On a platform whose interface grew over twenty years into a several-thousand-page estate, it is not. That is a structural difference rather than a matter of effort.

The interesting half is not the asking

An assistant that can only do things is a liability: it reports success because the call returned an acknowledgement, and nobody finds out otherwise until later.

What makes this worth having is that Phillux can look inside the guest. Running a command in there needs no network, no SSH, no key and no user account — so the loop closes: build it, ask whether the service is actually running, read the log if it is not, fix it, ask again, and only then say it is done.

Permissions are not re-invented

Every tool checks the same permission its endpoint checks, against the same user the API key belongs to. The scope of an assistant is therefore set the way the scope of a colleague is set: give it a key with the rights you mean it to have.

A key without the right to delete a VM cannot delete one, no matter how the conversation goes. That is worth more than any list of forbidden phrases, because it holds at the layer where the damage would be done rather than at the layer where it is described.

An assistant is not a new kind of user either. It appears in the same list as everybody else's keys, and it can be taken away the same way.

Everything slow is a task, and the tools wait

Almost every changing endpoint answers with an acknowledgement and a task id, because creating a disk takes minutes. A model that had to discover polling for itself would spend its attention on that instead of on the work, so the tools do the waiting.

The transport is deliberately plain: the client posts to a single address and reads the answer from the response. There is no session to keep, no stream to hold open and no second port — which is why this fits into the existing API server instead of needing a process of its own.

And the API for everyone else

Every function is a documented endpoint, and the interactive documentation is generated from the program itself, so it cannot go stale. Authentication is an API key that belongs to a user and does not expire, which is what scripts and build pipelines want.

That is the same surface the web interface uses. There is no privileged back door for the browser — anything the interface can do, a script can do.