Connections, MCP & Platform API

Critique’s Platform API (/api/v1/* + POST /api/mcp) lets external tools queue reviews, read structured verdicts, subscribe to lifecycle webhooks, and integrate IDE agents — without scraping the dashboard or GitHub comment threads.

Deep reference for agent integrators: Merge Gate API — queue → webhook/poll → findings[], MCP, Checkpoint pre-filter, writer/judge separation.

Product page with cookbooks: /merge-gate-api.

This page covers Connections (Linear, Slack, crt_ keys), MCP, and the full REST v1 catalog. Operators need CRITIQUE_SECRETS_ENCRYPTION_KEY before users can save keys.

Platform API surfaces (pick one)

All three HTTP surfaces share the same crt_ key family. One key can call merge gate, coding agent, and inference if scopes allow.

flowchart LR
  subgraph writers [Writer agents]
    Cursor[Cursor / Devin / Codex]
  end
  subgraph critique [Critique Platform API]
    Gate[Merge gate REST + MCP]
    Builder[Coding Agent API]
  end
  GH[GitHub PR] --> Gate
  Cursor --> GH
  Gate -->|findings[]| Fix[Fix agent or Remedy]
  Builder -->|optional draft PR| GH

Zapier vs MCP vs native (read this first)

Zapier (recommended)

For Slack, Jira, Sentry, Vercel, and most of your stack, use Zapier instead of pasting keys for each app in Critique. Combine Webhooks by Zapier with Critique crt_ API keys and MCP when agents need passport data.

Optional native Linear and Slack keys below are only for deep Critique Chat features (issue search, confirmed Slack posts).

Three ways to “connect” Critique

BYOK and BYOA stay on Settings. Linear and future integrations live under Connections so agents and chat can reuse the same encrypted credential store.

flowchart TB
  subgraph settings [Settings]
    BYOK[OpenRouter / Crof BYOK]
    BYOA[Cursor / Anthropic / OpenAI BYOA]
  end
  subgraph connections [Connections]
    Apps[Linear Slack Sentry …]
    CRT[crt_ API keys]
  end
  Chat[Critique Chat] --> BYOK
  Review[PR review] --> BYOK
  Fix[Queue fix agents] --> BYOA
  Chat --> Apps
  Agent[External agent MCP client] --> CRT
  CRT --> MCP["POST /api/mcp"]
  CRT --> REST["GET /api/v1/…"]

App connections (Linear and catalog)

Open Settings → Connections.

Linear (available now)

1. Create a Personal API key in Linear → Settings → API.
2. In Critique, open Linear → paste the key → Save.
3. Use Test connection to confirm Critique can reach Linear.
4. Toggle Enable for Chat (and other surfaces when they ship) so agents may call Linear-backed tools.

When Linear is connected and enabled for chat, Critique Chat can call searchIssuesAndRoadmap — search issues, see assignee context, and relate PR work to your roadmap without leaving the thread. See Chat tools.

Legacy Settings → Linear API key redirects to the same Linear card on the Connections page.

Slack (available now)

Connect with either:

1. Bot token (xoxb-…) from Slack API apps — needs chat:write (and channel access). Optional default channel (for example #eng-reviews).
2. Incoming webhook URL (https://hooks.slack.com/services/…) — fastest setup; posts to one channel only.

Use Test connection after save. When Slack is connected and Chat is enabled, Critique Chat can postToSlack — a confirmation card appears before anything is posted.

Other apps

Sentry, Jira, and Vercel are not configured as separate native Connections cards today. Use Zapier or Control Board incident webhooks (Change control) for now.

Current beta priorities:

• P0: agent orchestration docs and cookbook coverage for merge gate + Checkpoint webhooks
• P1: skills marketplace API-key scopes such as read:skills and install:skills
• P2: ship native Sentry and Jira OAuth cards instead of leaving them webhook-only

See the connections roadmap.

Critique API keys

API keys authenticate as your Critique user to automation endpoints. They are not OpenRouter keys and not Linear keys.

1. Go to Settings → Connections → Critique API keys.
2. Name the key (for example Cursor MCP or CI bot) → Create.
3. Copy the full key once — it starts with crt_ and is only shown at creation.
4. Store it in your agent or secret manager; Critique stores only a hash and a short prefix.

Default scopes on new keys:

Older keys created before the Coding Agent API or Inference API shipped may lack read:builder / write:builder or inference scopes — rotate the key in Connections if automation returns 403.

Inference API keys, limits, and usage: Inference API. Mini panel and caps live on this Connections page; full charts at /inference-dashboard.

Marketplace-oriented scopes such as read:skills and install:skills are planned but not live yet.

Browser session cookies do not satisfy scoped v1 checks. Use a crt_ key with the required scope for REST v1 and MCP.

OpenAPI: GET /api/v1/openapi (YAML). Machine-readable contract for passports, reviews, insights, repository policy, Coding Agent, and inference routes.

MCP server (beta, v0.1.0)

Critique exposes an MCP-compatible JSON-RPC endpoint for external clients (Cursor, Claude Desktop, custom agents).

This is a beta distribution surface. Tools enforce the same crt_ scopes as REST v1.

Tools

Example tools/call body (JSON-RPC):

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "list_passports",
    "arguments": { "limit": 10 }
  }
}

Configure your MCP client with the Critique URL and a crt_ key. MCP does not replace GitHub App install — the repository must already be on an installation you control.

REST API v1

HTTP JSON for the same account. Use a crt_ key with the required scope; authenticated browser sessions do not satisfy scoped v1 checks.

OpenAPI: GET /api/v1/openapi — YAML contract for automation teams.

Passports & reviews

Lifecycle webhooks (installation subscriptions)

Subscribe your HTTPS endpoint to review, Remedy, Checkpoint, merge-policy, and passport events for a GitHub App installation. V1 delivers each event once (no automatic retries); use GET /api/v1/review-runs/:id as a fallback if delivery fails.

Default events when omitted: review.run.completed, review.run.failed. Opt in to additional events explicitly (for example remedy.run.completed, checkpoint.gate.evaluated, passport.snapshot.created, merge_policy.evaluated).

Each delivery is an HTTPS POST with:

import crypto from 'node:crypto'

export function verifyCritiqueLifecycleWebhook(secret: string, rawBody: string, signature: string) {
  const expected = `sha256=${crypto.createHmac('sha256', secret).update(rawBody).digest('hex')}`
  return crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))
}

review.run.completed payloads include findings[] (structured severity, title, summary, file path, lines, fingerprint) and findingsCount. Poll GET /api/v1/review-runs/:id?findings=all if you need the full list after delivery.

Per-run review webhooks

Pass an optional webhook object on POST /api/v1/reviews (same shape as Coding Agent API runs: url, secret ≥32 chars, optional events). Critique delivers to that URL with User-Agent: Critique-Review-Webhook/1.0 and the same HMAC header names as lifecycle webhooks.

Installation lifecycle webhooks (review.run.completed, etc.) still fire in parallel when subscribed. Coding Agent run webhooks remain separate (Critique-Coding-Agent-Webhook/1.0).

Cookbooks and agent-loop examples: /merge-gate-api and Merge Gate API docs.

Signed-in dashboard (session cookie, not crt_):

Coding Agent API

OpenCode-backed sandbox runs with optional draft PR publish. Full reference: Coding Agent API.

Overview and curl examples: /coding-agent-api.

Inference API

OpenAI-compatible chat completions on Critique credits. Full reference: Inference API.

Overview, privacy copy, and key gate: /inference-api.

Account settings (signed in): GET / PATCH /api/settings/inference-api. Usage summary: GET /api/dashboard/inference-api.

Review-run BYOA exports (session or automation)

Handoff JSON for external agents from a completed review run (same blueprint as dashboard queue buttons):

Queueing still requires saved keys in Settings → Agents. See BYOA.

Example:

curl -sS \
  -H "Authorization: Bearer crt_YOUR_KEY" \
  "https://critique.sh/api/v1/passports?limit=5"

Responses are no-store and scoped to installations linked to your user.

Dashboard integration hub

Dashboard → Overview includes an integrations section when you have GitHub connected: connection status, Linear issue previews, passport queue snippets, and a Manage connections link to /settings/connections. Use it as a control-room view alongside review runs and usage.

Security practices

• Treat crt_ keys like passwords — revoke in Connections if leaked.
• Use separate keys per agent or environment so revocation is surgical.
• Linear and other connection secrets are encrypted at rest; Critique never returns full secrets to the browser after save.
• MCP and REST act only within your Critique permissions — they cannot access another user’s repositories.

Related

• Merge Gate API — primary doc for agent integrators
• Merge Gate product page — cookbooks and key gate
• BYOK — OpenRouter / Crof model keys (Settings)
• BYOA — Cursor (Composer 2.5), Claude, Codex fix agents (Settings → Agents)
• Coding Agent API — Builder-style writer runs over HTTP
• Inference API — OpenAI-compatible chat on Critique credits
• PR review — triggers, pipeline, GitHub output
• Checkpoint — pre-review gates + checkpoint.gate.evaluated webhooks
• Agent Skill Marketplace — publish and install review skills
• Chat tools — including searchIssuesAndRoadmap
• Environment variables — v4 change-control flags, v4.1 CRITIQUE_SECRETS_ENCRYPTION_KEY, and v6 webhook/API scopes
• Change control — passports, incident webhooks, model-feedback opt-in