The MCP server, answered in full.

The same pipeline exposed to agents as eleven tools over the Model Context Protocol, on local stdio or a remote URL. Two of the eleven are billable — resolving a company and comparing two records — and nine are free: read an entity, read a crosswalk, discover enrichment fields, search, redeem a decision receipt, read usage, and the three review-queue tools. It delegates to the same application services as the HTTP API, so a resolve over MCP is the same resolve, at the same price, against the same rate-limit bucket. Limits are shared rather than doubled. Deliberately absent: batch, catalogue export, erasure and provisioning, all of which stay on the HTTP surface.

No, and static bearer is the path to reach for first. The `rk_` API key you create in your Entity Bind workspace authenticates the remote MCP transport unchanged as an `Authorization: Bearer` header — the option credential vaults call `static_bearer`. OAuth exists, with PKCE S256 required, one issuable scope and operator-registered clients, but there is an integration gap to know about before you plan around it: the listener publishes no RFC 9728 protected-resource metadata and answers an unauthenticated tool call with a tool error rather than a 401 challenge. A client that starts its OAuth flow from a 401 will never start it. Discovery-driven clients work only behind a shared origin.

Every billable tool returns a `usage` block — credits charged, credits remaining, deep attempts remaining, plan, and whether billing is enforced — and that block is the only place an agent can learn what a call cost, because a tool call has no response headers to read. So an agent can audit its own spend rather than be told it is cheap. The credential also caps depth before the cascade runs, so a key pinned to `probabilistic` cannot reach agentic research by choosing this surface. And the abstention rule holds here too: Free-tier or not, an `unresolved` costs zero credits, so an agent asking a question nobody can answer is not a bill.

No, structurally rather than by policy. There is no erasure tool and no provisioning tool on the MCP surface, and an admin-scoped key is refused outright before a caller object is even constructed — so the credential that can mint credentials is unreachable by a model. Tenancy is derived per call from the credential and is never a request parameter; every repository method requires a tenant id as a keyword argument with no default; and a cross-tenant read reports 404 rather than 403. An erasure obligation is discharged by a person who can be asked why, which is a support conversation rather than a step in an agent's plan.