# Sidemex

> Voice agents, Sidemex AI and a scoped workspace MCP for the account owner.

## Public documentation
- [MCP and TypeScript SDK guide](https://sidemex.net/docs/agents/): Authentication, scopes, setup, tools, credit usage and complete lifecycle examples.
- [Developer overview](https://sidemex.app/docs): Public introduction and integration links.
- [Discovery JSON](https://sidemex.app/.well-known/mcp.json): Endpoint, supported tools and permissions.

## MCP connection
Endpoint: https://sidemex.app/api/medusa/ai/agents/sdmx/mcp
Transport: Streamable HTTP. Protocol: 2025-11-25.
Authentication: Authorization: Bearer <account-owned workspace grant token>.
Initialize first, retain the returned Mcp-Session-Id, send notifications/initialized,
then send MCP-Protocol-Version and Mcp-Session-Id with tools/list and tools/call.
The live tools/list response is authoritative for the granted tools and JSON schemas.

## Agent lifecycle
Use agents:write for creation, draft configuration and business intake.
Use agents:publish for profile approval, publication, activation and pause.
Review and approve your business context before publication. Activation may
complete asynchronously. Creating a token authorizes only its selected scopes.
Inspect agent_operation_read with the operation and requestId before recovery.
Reuse the same requestId and arguments to recover a completed mutation receipt.
Do not automatically replay a mutation with a new requestId.

## Credits and account access
1,000 Sidemex credits represent USD 1 of consumption balance before taxes.
Voice, Sidemex AI and billable intake draw from the same account balance.
The configured plan, balance and credit checks apply equally to dashboard and MCP.
Billing rates and capabilities can change: check the live account and tool response.

## Boundaries for assistant clients
Never request or expose provider keys, grant tokens or another account's agents.
Review business information gathered from your website or Google Maps before publication.
WhatsApp account chat requires a verified account connection and permissions.
This file and the discovery JSON describe the service; they do not grant access.