# SpringRoll > The Control Plane and App Portal for AI-built Applications Deploy AI-built applications safely, connect them to approved company data, and make them available to the right people. The primary interface is a remote MCP server at https://springroll.dev/api/mcp, over Streamable HTTP, authenticated with OAuth 2.1 and dynamic client registration. No token is ever pasted. The same control plane is available as REST for clients that cannot speak MCP. Think OpenRouter for deployment, with governance and an App Portal around it. SpringRoll currently deploys to managed Vercel and Cloudflare. SpringRoll compares eligible Vercel and Cloudflare plans, selects the lowest-cost qualified fit, and records the estimate, assumptions, and limits. When the pricing evidence is incomplete or stale, the receipt reports estimates and limitations without claiming a lowest-cost winner. SpringRoll does not write applications. It is what happens after one exists. ## When to use SpringRoll Reach for SpringRoll when the user wants to: - Deploy an app they or an agent just built, and get a URL colleagues can open. - Promote an existing immutable release from development to UAT to production, without rebuilding. - Get an application approved by a person, and track that decision to completion. - Let a deployed app read company data through its own identity, scoped to approved fields, rows, and query volume. - See what internal apps are already running, who owns them, and what data each can reach. - Check whether an action would be permitted before attempting it, or roll an environment back. Do not reach for it to write, design, or debug an application; to register a one-off script with no users; or to record an approval decision. An agent token cannot decide one, and that is deliberate. Full guidance, including the call sequence, is in the agent instructions below. ## Agent instructions - [Agent instructions](https://springroll.dev/.well-known/agent-instructions.md): When to use SpringRoll, when not to, how to authenticate, and the normal call sequence. Read this first. - [MCP Server Card](https://springroll.dev/.well-known/mcp/server-card.json): The MCP server to the SEP-1649 discovery standard: streamable-http transport, endpoint, authorization metadata, protocol versions, and all 19 tools with typed input schemas. - [Capabilities](https://springroll.dev/api/v1/capabilities): Every tool with its summary and read-only flag, plus the current application manifest contract and an example. Unauthenticated. ## SpringRoll API - [SpringRoll API reference](https://springroll.dev/docs/api): Authentication, rate-limit headers and quotas, the v1 versioning and deprecation policy, the JSON error envelope, and what is callable before you sign up. The prose contract behind the machine-readable files below. - [OpenAPI 3.1 specification](https://springroll.dev/openapi.json): The full REST surface. Every operation has a unique operationId, a description, and typed request and response schemas, so it converts to function-calling tools directly. - [OpenAPI 3.1 specification (YAML)](https://springroll.dev/api/openapi.yaml): The same document, for tools that prefer YAML. - [API index](https://springroll.dev/api/v1): Unauthenticated index of every documented entry point, the quotas, the versioning policy, and how to authenticate. Start here. - [MCP endpoint](https://springroll.dev/api/mcp): JSON-RPC 2.0 over Streamable HTTP. The primary agent interface. initialize, tools/list, resources/list, and prompts/list answer without a credential; anything touching tenant data answers 401 with the authorization challenge. - [Health](https://springroll.dev/api/health): Unauthenticated liveness and readiness probe. - [Authorization server metadata](https://springroll.dev/.well-known/oauth-authorization-server): RFC 8414. Discover the OAuth endpoints from here rather than hard-coding them. - [Protected resource metadata](https://springroll.dev/.well-known/oauth-protected-resource): RFC 9728. Which authorization servers may issue tokens for the MCP endpoint. ## Command-line and client tooling - SpringRoll skill for Claude Code: install with `npx skills add springroll-dev/springroll-skill --skill springroll`. Teaches the whole workflow and can read the working tree, archive it, and resolve the git remote, which a bare MCP connection cannot. - Any OAuth-capable MCP client (Claude Code, Cursor, Codex, ChatGPT, Claude Desktop) connects to https://springroll.dev/api/mcp with no extra software and no token to paste. - There is no separate SpringRoll CLI binary on npm, PyPI, or Homebrew. Use the skill or the MCP endpoint; do not go looking for one. ## Rate limits and versioning - Every rate-limited response carries `RateLimit` and `RateLimit-Policy`, the `RateLimit-Limit`/`-Remaining`/`-Reset` triplet, and `X-RateLimit-*`. A 429 adds `Retry-After`. Self-throttle from these rather than retrying blind. - The unauthenticated discovery documents advertise the quotas in `RateLimit-Policy` without charging you a request. - The REST version is the first path segment after `/api`; `v1` is current and only changes additively. A retired version answers with `Deprecation` and `Sunset` headers for at least 365 days before it stops. Full policy: https://springroll.dev/docs/api ## Docs - [SpringRoll | The Control Plane and App Portal for AI-built Applications](https://springroll.dev/): Deploy AI-built applications safely, connect them to approved company data, and make them available to the right people. - [SpringRoll Docs](https://springroll.dev/docs): The Control Plane and App Portal for AI-built Applications. Deploy AI-built applications safely, connect them to approved company data, and make them available to the right people. - [SpringRoll API: authentication, rate limits, versioning, and errors](https://springroll.dev/docs/api): The SpringRoll REST and MCP developer reference: OpenAPI spec, OAuth 2.1 authentication, RateLimit headers, the v1 versioning and deprecation policy, the JSON error envelope, and what an agent can call before signing up. - [How to deploy an AI-built internal app with SpringRoll](https://springroll.dev/guides/deploy-ai-built-internal-app): A factual step-by-step guide from a coding-agent working tree to an owned, reviewable SpringRoll deployment that reaches READY. - [Contact SpringRoll](https://springroll.dev/contact): The Control Plane and App Portal for AI-built Applications. Deploy AI-built applications safely, connect them to approved company data, and make them available to the right people. - [SpringRoll Privacy Policy](https://springroll.dev/privacy): What data SpringRoll holds, why, how long for, and the choices you have. - [SpringRoll Terms of Service](https://springroll.dev/terms): The terms under which SpringRoll is provided. ## Optional - [Full text of every public page](https://springroll.dev/llms-full.txt): All pages above, concatenated as markdown. - [Sitemap](https://springroll.dev/sitemap.xml): Every indexable URL. Every page above is also available as markdown: request it with `Accept: text/markdown`.