Agency data access

Who it is for

Government agencies, research bodies and insurers can read the shared layers of Coastal Intelligence on demand: from an AI assistant or agent through an MCP server (Model Context Protocol), or from any program through plain REST. Access is read-only, scoped to an approved request, rate limited and logged call by call.

How to request access

1. Sign in with your work e-mail. Use an account that is not linked to a farm or co-op profile: those accounts cannot request agency access.
2. Open Request data access and fill in the organisation, the purpose (what the data is for and who will see it), the bays, the products, the aggregation and the date range.
3. An administrator reviews the request and approves or declines it. You can follow its status on the same page. On approval the administrator receives an API key, shown to them once, and sends it to you over a secure channel. Only a hash of the key is stored.
4. The key's scope is exactly the approved request. To change the scope, send a new request. An administrator can revoke a key or the whole request at any time; the next call with it is refused.

Products and aggregation

• Derived products: signals, events, skill, backtest, risk_index.
• Raw time series: one product per shared dataset (for example phy_daily, wav_hourly, sst_l4, era5_single, buoys, tide_gauges). The request form lists every product with a short description.
• Aggregation bay gives bay aggregates only, with per-site series only at ground-truth stations such as a buoy. Aggregation site adds per-site series.

The tools

The same tools answer over MCP and REST. GET /agency/tools lists them with their parameters.

• Dates are UTC days (YYYY-MM-DD). Over MCP the date arguments are from_date and to_date; over REST the from and to query parameters.
• An omitted range means the last 30 days up to today plus the 10-day forecast horizon, inside your approved range. One call covers at most 366 days.
• Every data row carries source, product, scale (regional, satellite or site), lead_hours (empty for observations and dated events, 0 for analyses, above 0 for forecasts) and licence.
• Every result also carries your scope, the licences used, the attribution lines they require (keep them when you publish: see Licences and attribution) and a notice.

Signals are favourable, marginal or unfavourable style indicators, not food-safety advice. For shellfish harvesting and food safety always follow the official closures (Marine Institute HAB bulletin, SFPA).

What is never shared

• Operator records: data loggers, harvest, mortality and seaweed logs, webhook series, notes, photos, briefs and post-mortems. They are not a product, the queries exclude them, and a last check refuses any result that would contain one.
• Operability signals (they encode a farm's own working limits), and the thermal and runoff back-test rows (they are scored against operator records). Only the bloom back-test is shared.
• Personal data: operator names and contacts, account e-mails.
• Anything outside your approved bays, products, aggregation and date range.

How to connect

MCP endpoint https://coastal-intelligence.triskelionaisystems.com/api/mcp, Model Context Protocol over streamable HTTP. Send the key in the Authorization: Bearer <key> header (X-API-Key: <key> also works).

Claude Code and other clients that read an mcpServers file

Keep the key in an environment variable (AGENCY_KEY), not in the file:

{
  "mcpServers": {
    "coastal-intelligence": {
      "type": "http",
      "url": "https://coastal-intelligence.triskelionaisystems.com/api/mcp",
      "headers": {
        "Authorization": "Bearer ${AGENCY_KEY}"
      }
    }
  }
}

Claude Desktop and clients that only start local commands

Bridge to the HTTP endpoint with mcp-remote (needs Node.js):

{
  "mcpServers": {
    "coastal-intelligence": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://coastal-intelligence.triskelionaisystems.com/api/mcp",
        "--header",
        "Authorization:Bearer ${AGENCY_KEY}"
      ],
      "env": {
        "AGENCY_KEY": "<your key>"
      }
    }
  }
}

Plain REST

curl -H "Authorization: Bearer $AGENCY_KEY" \
  "https://coastal-intelligence.triskelionaisystems.com/api/agency/events?bay=<bay id>&from=<YYYY-MM-DD>&to=<YYYY-MM-DD>"

Limits, errors and audit

• Rate limit: a fixed number of calls per minute per key, MCP and REST together (60 unless the deployment sets another value). Over it the answer is 429 with Retry-After.
• Errors: 401 for a missing, unknown or revoked key; outside your scope, REST answers 403 and MCP a tool result with isError: true and the reason; 404 for an unknown bay or site; 422 for bad parameters.
• Audit: every call is logged with its time, key prefix, channel (MCP or REST), tool, arguments, outcome, status, row count and a truncated client IP. The key itself is never logged. Requests, approvals, denials, revocations and key issues are logged too.