Docs

AI & the local API

Your assistant can see the project. The project never leaves the machine.

Plaza can run a tiny HTTP server on your machine so your own tools and AI assistants can query your projects: "what's the latest version of shot 040?", "what's still in Review?", "which renders came from this scene?". It is off by default, loopback-only (never reachable from the network), token-authenticated, and read-only unless you explicitly grant more.

Turning it on

Settings → Local API: enable it, note the port (default 7373), and copy the access token (Regenerate revokes the old one). Every request needs the token as a bearer header.

Connecting an assistant (MCP)

The server speaks MCP at POST /mcp (streamable HTTP). Point any MCP-capable client — Claude Code, Claude Desktop, Cursor — at it:

The assistant gets 15 read-only tools: projects, the currently open project, file search (per-project and across projects), folder listings, recents, file info with resolved attribute values, the attribute and naming schema, find-by-attribute, tasks, to-dos, the board, favorites, project stats and version stacks.

Extended access — still never your files

A separate Extended access toggle adds five more tools: set an attribute value, create and update tasks, view a file's thumbnail, and read a text file (capped, text formats only). The line that never moves: the API cannot move, rename, delete or write your actual files — extended mode writes Plaza metadata and the to-do list, nothing else. Online-only cloud files are never downloaded to answer an API call.

Scripting it yourself

The same server exposes a plain REST surface under /v1 — GET /v1/projects, /v1/projects/:id/files?q=shot, /tasks, /values, /board and friends, all JSON, all read-only. GET /v1/health is the only unauthenticated route.

Security shape, in one breath: binds 127.0.0.1 only · bearer token · Host-header pinning against DNS-rebind · no CORS · GET-only REST · caps on every listing.