Xenmark/Blog/The Xenmark Integration API, and an MCP server for your AI assistant

The Xenmark Integration API, and an MCP server for your AI assistant

Xenmark has always kept the drawing, the comments, the replies and the revision history in one place. This week we opened a door to that place from the outside: a read-only Integration API, and an MCP server built on it so your AI assistant can answer questions about your reviews.

Both follow the same rule. Your password is never entered anywhere except Xenmark itself. Every integration pairs with a token you create inside the app, and you can revoke it at any time.

A read-only API, paired with a token

The Xenmark Integration API lives at api.xenmark.app and covers the parts of a review you would want to read from somewhere else:

  • Who you are — your account and organisation.
  • Notifications — your inbox of comments, replies and mentions, newest first, with a cursor so a tool can pick up exactly where it left off.
  • Projects, drawings and revisions — the projects you are a member of, the drawings in each, and the revisions of each drawing.
  • Review data — a summary per revision (how many comments are open, in progress and closed), the comments on a revision, and the replies on a comment.

Every row that points at something in Xenmark carries a web_url, so a tool can always send you straight to the drawing or the comment it is talking about.

The API is read-only by design and stays that way. Nothing outside Xenmark can create a comment, change a status, upload a drawing or touch a project on your behalf. It never returns e-mail addresses, files, billing details or account roles, and it never reaches a project you are not a member of. Requests are rate-limited per token — 120 per hour and 20 per minute — which is plenty for a notification checker or an assistant, and a natural brake on anything heavier.

Getting a token takes a minute

Open your profile in Xenmark and go to Account & Security → Connected apps → Connect an app. Choose Personal API token (Postman, GitHub) and generate one. The token is shown once; paste it into the tool that needs it and nowhere else. You can hold up to five tokens, one per tool, and disconnect any of them from the same screen. Disconnecting a token stops the tool immediately.

Documented on Postman, published on GitHub

Two places to start, depending on how you like to work:

  • Postman — the whole API as runnable requests, with a Getting Started section that walks through the token, the variables and your first call. Nothing to install.
  • GitHub — the contract itself: the OpenAPI 3.0 specification of every route, the Postman collection, and a changelog that tracks each API release. Published under Creative Commons Attribution 4.0, so you can copy the schema straight into your own tools.

Both are kept in step with the API. When the contract changes, the version number changes with it, and the changelog says what moved.

Ask your AI assistant about your reviews

The part we are most pleased with is what sits on top of the API. Xenmark MCP is a small open-source server that connects an AI assistant — Claude Desktop, Cursor, VS Code, or any other tool that speaks the Model Context Protocol — to your Xenmark data.

Once it is installed, you can simply ask:

  • “Anything new for me in Xenmark?”
  • “Which projects am I on, and what’s my role?”
  • “What’s still open on drawing 1001-300, Rev. B?”
  • “List the unresolved comments on that revision and who raised them.”
  • “What did Greta reply on comment #7?”

The assistant reads the inbox, the revisions, the summaries and the comments through the API, works out the answer, and gives it to you with a link into Xenmark for every item it mentions. In our own testing the second question above took the assistant four calls — revisions, summary, comments, and the replies it needed — and came back with the open items listed by number, each one clickable.

It runs on your own machine, talks to exactly one server (api.xenmark.app), stores nothing, and cannot write to Xenmark because the API it uses cannot either. The token lives in your assistant’s configuration file and nowhere else.

Installing the MCP server

You need Node.js 18 or newer and a Personal API token. Then add one entry to your assistant’s MCP configuration — for Claude Desktop that is claude_desktop_config.json (Settings → Developer → Edit Config):

{
  "mcpServers": {
    "xenmark": {
      "command": "npx",
      "args": ["-y", "xenmark-mcp"],
      "env": { "XENMARK_TOKEN": "xmk_live_YOUR_TOKEN_HERE" }
    }
  }
}

Restart the assistant and the Xenmark tools appear. Cursor and VS Code take the same entry in their own MCP settings. The full instructions, the licence (MIT) and the security notes are in the repository.

Coming to your browser of choice

The first integration we built on this API was the simplest one: a browser extension that pairs once with a connect code and shows your Xenmark notifications — comments, replies and mentions — as desktop alerts, with a click that takes you to the right comment. It is submitted to the Chrome Web Store, Microsoft Edge Add-ons, Firefox Add-ons and Opera Add-ons, and each listing will appear on the Integrations page as it goes live.

Notifications from the API, coming to your browser of choice.

← All posts