Point an agent at your conference.
vibeboard speaks MCP and plain REST. An agent can read your published program with no credentials at all — and with a key you mint and can revoke, it can do the parts of the job you would otherwise do by hand: chase missing headshots, find the schedule conflicts, draft the decline list.
$ claude mcp add --transport http vibeboard https://vibeboard.io/mcpThat gets you six read tools over published program data. Add a key and the same six answer with your organizer view, and three more appear — minting one takes a click.
Start here
Try it with no key at all
Every event's published program is machine-readable without any credential. This is the whole request — no account, no token, no signup:
curl https://vibeboard.io/ai-builders-summit-2026/feed.json
You get the event, its timezone, and every published session with speakers, room and time. The same data is available as feed.ics (subscribable calendar) and feed.xml (frab schedule.xml, which existing conference apps already read). Two more endpoints need no key either: GET /api/v1 lists the entire surface, and the OpenAPI document describes it.
The MCP endpoint answers unauthenticated too. Before wiring up a client, this is the fastest way to see exactly which tools you get with no credential at all:
curl -X POST https://vibeboard.io/mcp \
-H "Content-Type: application/json" \
-H "Accept: application/json, text/event-stream" \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'Connect
Three ways to add the MCP server
The server is a streamable HTTP endpoint at https://vibeboard.io/mcp. Pick whichever your client speaks.
1 · Claude Code
One command, with or without a key.
# public tools only claude mcp add --transport http vibeboard https://vibeboard.io/mcp # with an event key, for organizer tools claude mcp add --transport http vibeboard https://vibeboard.io/mcp \ --header "Authorization: Bearer YOUR_API_KEY"
2 · Any client that reads an mcpServers block
Claude Desktop, Cursor, Windsurf, VS Code and friends. Drop this into the config file your client uses; omit headers for the public tier.
{
"mcpServers": {
"vibeboard": {
"type": "http",
"url": "https://vibeboard.io/mcp",
"headers": {
"Authorization": "Bearer YOUR_API_KEY"
}
}
}
}3 · stdio-only clients
Older clients that can only launch a local process reach the same server through mcp-remote, which bridges stdio to HTTP.
npx -y mcp-remote https://vibeboard.io/mcp
{
"mcpServers": {
"vibeboard": {
"command": "npx",
"args": [
"-y",
"mcp-remote",
"https://vibeboard.io/mcp",
"--header",
"Authorization: Bearer YOUR_API_KEY"
]
}
}
}Tools
What an agent can call
A short list of tools that each do a whole job, rather than a wrapper around every table. Six of them need nothing at all — and rather than a separate authenticated set, those same six answer with your organizer view once a key is present: more rows, more fields, the same names. Three tools appear only with a key.
| Tool | What it does | Needs |
|---|---|---|
list_events | Conferences on this instance with a published program, and their dates. | No key |
get_event | One conference: dates, venue, whether the CFP is open. With a key, the counts an organizer runs it by. | No key |
get_agenda | The published agenda, bucketed by day in event-local time. With a key, the draft grid and its conflicts. | No key |
get_sessions | Published talks, filterable by track, format or free text. With a key, every proposal and its review scores. | No key |
get_speakers | The public speaker directory. With a key, the full roster including contact details. | No key |
get_cfp_form | What it takes to submit: whether the call is open, when it closes, and every question on the form. | No key |
preview_notify | Exactly who is queued to hear from you and precisely what they would be told. Sends nothing. | API key |
place_session | Put an accepted talk in a room and time slot, refusing — and naming the clash — if it would double-book a room or a speaker. | API key + confirm |
set_submission_decision | Accept, decline or shortlist a proposal. Stages the decision exactly as the buttons do, and emails nobody. | API key + confirm |
No key works with no credential and reads published, content-approved data — the same rows an anonymous visitor already sees. With a key, those tools widen to the organizer's view of that one event. API key is a read only an organizer could do. API key + confirm changes the program: called without confirm: true it returns the plan — the exact slot, the exact status change — and writes nothing.
Safety
What a connected agent can reach
With no credential, the server reads only published, content-approved program data — exactly what an anonymous visitor can already see on your event's public pages. Everything beyond that needs an event API key, and every write additionally needs confirm: true in the call, so a model exploring your data cannot change it while it is just looking. A key can do nothing an organizer of that event could not do by hand: it is scoped to one event, it cannot widen its own permissions, and it reaches no data the organizer UI would not show the person who created it.
Scoped at the query, not the prompt
Every statement filters by the event id on the key row. The event id in a URL or a tool argument is only ever compared against it, never trusted — so no instruction an agent reads can talk it into another event's data.
Revocable, and countable
Keys are hashed at rest and shown once. Revoke one in Settings → API and everything using it stops immediately. Each is capped at 120 requests a minute, reported on every response so a client can pace itself.
Writes go the normal way, and stay quiet
A decision made through a tool runs the product's own action — the same onboarding tasks, the same place in the app as one made by a human clicking Accept. What it does not do is email anyone: tools stage, organizers announce. Read the pending outbox first with preview_notify.
Self-hosting? This is the whole story: one MIT-licensed repo, your Cloudflare account, your database. The MCP server and the REST API are part of the same deploy — there is no hosted middleman between an agent and your event, and no tier that unlocks them.
REST & OpenAPI
Or skip MCP and call the API
Everything the tools do sits on a read API you can call directly. It is described by a generated OpenAPI 3.1 document — generated, not hand-written, from the same modules the handlers run on, so it describes what the server does rather than what someone remembered to write down. Point your code generator at it:
curl https://vibeboard.io/api/v1/openapi.json
curl "https://vibeboard.io/api/v1/sessions?status=accepted" \ -H "Authorization: Bearer YOUR_API_KEY"
Two shapes, one behaviour. The native endpoints are camelCase with { data, pagination }. The event-nested endpoints use snake_case and the envelopes the Sessionboard Public API documents, so an integration written from those docs runs here unchanged.
Three header names work. Authorization: Bearer, x-access-token and x-api-key all authenticate, so a client written for another platform usually needs no changes.
Honest gaps. Resources vibeboard genuinely does not model — sponsors, exhibitors, general contacts, per-session languages — answer 501 with an explanation, rather than an empty list a client would read as real data.
Keys
Minting one
Open your event, go to Settings → API, name a key after whatever will use it, and copy it — it is shown once and stored only as a hash. The same screen lists every key, when it was last used, and a Revoke button.
Signed out, that link sends you to the sign-in page — the demo has one-click logins for the organizer, reviewer and speaker roles.