Build Intelligence: Turn Your AI Editor Into a Rylvo Control Plane

The way developers build AI agents is changing. Instead of switching between dashboards, documentation, and terminals, what if your AI editor could be the control plane? What if a single sentence in Claude Code could spin up a bot, wire it to a knowledge base, and deploy it to production — without you ever leaving your IDE?

That is exactly what Rylvo Build Intelligence delivers.

Build Intelligence is Rylvo's native integration layer for the Model Context Protocol (MCP) — the open standard that lets AI editors discover and call external tools as first-class functions. With one install command, your editor gains 30+ scoped tools to read, write, and manage every Rylvo primitive: bots, prompts, guardrails, skills, workflows, MCP servers, and knowledge-base connections.

In this post, we'll cover:

• What Build Intelligence is and how it works
• The 30+ tools your AI editor can call
• Supported editors and one-command installation
• The OpenAPI 3.1 bridge for non-MCP models
• Enterprise security: OAuth 2.1 + PKCE, RS256 JWTs, and org-scoped authorization
• The MCP Hub: registry, credential vault, approvals, and observability
• Bot-as-MCP export for agent composition
• Scheduled Messaging: proactive outbound bot communication
• Data Collection & Checkpoints: structured user intelligence
• Why this changes how teams build AI software

What Is Build Intelligence?

Build Intelligence connects any function-calling AI — whether it lives in Claude Code, Cursor, Windsurf, Zed, Codex CLI, or a custom OpenAI / Gemini pipeline — directly to your Rylvo organization. Instead of pointing and clicking in a dashboard, you describe what you want in natural language, and your AI translates that intent into precise API calls.

The result: your editor becomes a Rylvo operator.

Create a customer-support bot? Just say:

"Create a bot called SupportBot with a friendly tone, wire it to our Zendesk knowledge base, and add a guardrail that prevents it from making refund promises."

Your AI editor sees that Rylvo exposes a scaffold_bot_from_description macro tool. It calls the tool. The bot is created, the prompt is written, the guardrail is registered, and the knowledge-base connection is established — all in a single composite operation.

No context switching. No copy-pasting API keys. No YAML hand-editing.

How It Works: Five Steps, Under a Minute

The installation flow is deliberately minimal:

1. Run the install command in your AI editor — one shell line.
2. Browser OAuth opens automatically and asks you to sign in to Rylvo.
3. A token is issued — an RS256 JWT with a one-hour TTL, bound to your organization.
4. 30 tools become available in your editor, scoped to your org only.
5. Build in natural language — create bots, prompts, guardrails, skills, and more.

For Claude Code, it is literally:

claude mcp add rylvo https://rylvo.com/mcp

For Cursor, add a Streamable HTTP server with the same URL. For Windsurf, use the CLI:

codeium mcp install rylvo --url https://rylvo.com/mcp

For Zed, add an entry to your settings.json.

OAuth is handled automatically. No tokens to paste. No API keys to rotate manually.

The 30+ Tools Your AI Can Call

Build Intelligence exposes 30 resource tools across seven Rylvo primitives, plus 3 macro tools that compose frequent multi-step operations.

Resource Tools

Macro Tools (Composite Operations)

• scaffold_bot_from_description — One call creates a bot, writes its system prompt, and adds a starter guardrail from a natural-language brief.
• clone_bot — Duplicates a bot; deep_copy_resources=true also copies linked prompts and guardrails.
• attach_mcp_server — Registers an external MCP server, writes its tool list, and links it to bots — all in one call.

These macros are the secret to velocity. They collapse what used to be five dashboard tabs and a dozen clicks into a single conversational sentence.

Not Using MCP? Use OpenAPI 3.1

Build Intelligence is not limited to MCP-native editors. Any model that supports function calling — OpenAI Responses, Google Gemini, Moonshot Kimi, or open-source tool-using LLMs — can ingest Rylvo's OpenAPI 3.1 spec at /openapi.json and gain typed tools for every endpoint.

Same auth. Same org-scoping. Same 30+ capabilities. Just served in the shape your model already speaks.

import httpx, openai
spec = httpx.get("https://rylvo.com/openapi.json").json()
# map operations → function tools, pass to
# client.responses.create(tools=[...])

This means you can embed Rylvo tools inside existing AI pipelines, data workflows, or custom chat UIs without adopting MCP at all.

Enterprise Security: Short-Lived, Org-Scoped, Auditable

Every access token issued by Build Intelligence is a narrowly-scoped JWT with the following guarantees:

RS256 JWT Signing

Access tokens are signed with RS256 asymmetric keys. Your clients verify with a public JWKS endpoint — no shared secrets, no symmetric key rotation drama.

One-Hour TTL

Tokens expire quickly. A leaked token becomes useless within the hour, minimizing blast radius.

PKCE S256 (OAuth 2.1)

Public clients — like CLI editors — have no embedded secrets. The OAuth flow uses PKCE with S256 challenge methods. Plain challenges are rejected in production.

Org-Scoped on Every Call

Every JWT carries an org_id claim. Every tool invocation re-verifies that claim against the resource being touched. A token that leaks cannot reach another tenant — the middleware returns 403 before the handler even runs.

Refresh Token Rotation

Refresh tokens rotate on every exchange. When you refresh, you receive a new refresh token. Old ones are invalidated. This makes token theft a race the attacker almost always loses.

Full Audit Trail

Every MCP call and OAuth event is recorded in the Audit Log with actor, status, and timestamp. Your compliance team will love it.

MCP Hub: The Enterprise Control Plane

Build Intelligence is not just an API surface — it is backed by MCP Hub, Rylvo's enterprise control plane for MCP servers. MCP Hub gives operators the governance layer every production AI deployment needs.

Curated Registry

Install vetted MCP servers from trusted vendors — GitHub, Slack, Notion, Linear, Jira, Stripe, HubSpot, Brave Search, Postgres, and more — with one click. Each server is tagged with a trust level: Rylvo Verified, Community, or Custom.

Encrypted Credential Vault

Credentials are encrypted server-side with AES-256-GCM and stored in a dedicated vault. Plaintext never touches Firestore or the client. Only the last four characters are visible in the UI. Credentials are decrypted only at invocation time on the server, used once, and never logged.

Per-Tool Permissions

Control every tool at granular level:

• Allow — Bot calls the tool without human intervention.
• Require Approval — Bot pauses and creates an approval request in Mission Control.
• Deny — Tool is hidden from the bot entirely.

Risk-based defaults apply automatically: read operations default to Allow, while merge-PRs and refunds default to Require Approval.

Human-in-the-Loop Approvals

When a bot calls a high-risk tool, the execution pauses. An operator reviews the tool name, arguments preview, and LLM rationale, then approves or denies. The bot resumes automatically upon approval, or receives a graceful denial. Timeouts auto-deny so conversations never hang.

Bot-as-MCP Export

Any Rylvo bot can be exported as an MCP server with a single toggle. Its tools become discoverable MCP endpoints that other bots — or external clients — can invoke over HTTP. This enables:

• Agent teams — manager bots delegate to specialist bots
• Team-wide reuse — one bot maintains your CRM sync; every other bot calls it
• Micro-agent architecture — break monolithic bots into focused, composable services

Observability & Alerts

MCP Hub tracks daily spend per server, call volume with failure-rate breakdown, health status with latency tracking, and denial rates that signal permission tuning needs. Automated alerts fire on server-down events, cost spikes, failure-rate spikes, and approval backlogs.

Scheduled Messaging: Proactive Outbound Bot Communication

Most chatbot platforms are purely reactive — they wait for a user to send a message, then respond. Rylvo breaks that limitation with Bot Broadcasts, a powerful scheduled messaging system that lets your bots proactively reach out to your audience.

What Are Bot Broadcasts?

Bot Broadcasts are scheduled outbound messages sent by your bot to targeted recipients across any channel. They combine audience intelligence, message templating, scheduling, and multi-channel delivery into a single workflow.

Key capabilities:

• One-time or recurring schedules — Send a message once at a specific time, or set up repeating broadcasts on hourly, daily, weekly, biweekly, or monthly cadence
• Audience targeting — Send to all users, hand-picked recipients, or dynamic audience segments defined by behavior, channel, or custom filters
• LLM-powered personalization — Use your bot's LLM to customize each message per recipient, or send static templates with variable substitution
• Multi-channel delivery — Reach users on WhatsApp, Slack, Telegram, Discord, SMS, email, or any other channel with automatic fallback if the primary channel fails
• Timezone awareness — Schedule broadcasts in the recipient's local timezone

How Broadcasts Work

1. Compose — Write a message template with variables like {{first_name}} or {{plan_tier}}. Optionally enable LLM mode to let the bot rewrite the message for each user.
2. Target — Choose your audience: everyone, specific users, or a saved segment like "inactive users in the last 7 days."
3. Schedule — Pick one-time (e.g., "send Friday at 9 AM UTC") or recurring (e.g., "send every Monday at 8 AM").
4. Deliver — The Cloud Function runner checks every 5 minutes and fires due broadcasts automatically, tracking sent counts, failures, and delivery status.
5. Analyze — View run history, open rates, and engagement per broadcast.

Use Cases

• Re-engagement campaigns — "Hi Sarah, we noticed you haven't logged in for a week. Here's what's new..."
• Appointment reminders — Automated reminders sent via WhatsApp or SMS the day before a scheduled meeting
• Weekly digests — Personalized summary of activity, sent every Monday morning
• Onboarding nudges — Targeted follow-ups for users who haven't completed key onboarding checkpoints
• Transactional updates — Order status, shipping notifications, payment confirmations

Bot Broadcasts turn your bot from a passive support tool into an active communication engine.

Data Collection & Checkpoints: Structured User Intelligence

A bot conversation is valuable not just for what the bot says, but for what the bot learns about the user. Rylvo's Data Collection & Checkpoints feature lets you capture structured information from every conversation and track user progress through defined milestones.

Configurable Collection Schema

Every bot can define a collection schema — a structured set of fields you want to gather from users:

Two Collection Modes

Asked Fields — The bot explicitly asks the user for the information. The bot tracks what has been collected, what is missing, and which required fields are still outstanding. It gently nudges the conversation toward completion without being robotic.

AI-Inferred Fields — The bot extracts information naturally from the conversation flow. If a user says "I work at Acme Corp as a VP of Engineering," the bot infers company = "Acme Corp" and job_title = "VP of Engineering" without asking directly. These are extracted post-session by an AI pipeline.

Checkpoints: Milestone Tracking

Checkpoints are achievement markers tied to specific conditions. They track whether a user has completed key milestones:

• Requires gating — A checkpoint can require specific fields to be collected first. You cannot mark "onboarding_complete" until email, company, and use_case are all filled.
• Bot-achieved — The bot calls set_checkpoint(key) when it detects the condition is met (e.g., the user says "yes, that solved my problem" → issue_resolved checkpoint achieved).
• Progress tracking — Every user profile shows which checkpoints are achieved and which are pending.

Validation Pipeline

Data quality matters. Rylvo validates every collected field at two levels:

Local Validation — Type checking and regex matching in-process:

• Email format validation
• Phone number normalization (strips spaces, dashes, validates length)
• Number parsing
• URL validation
• Enum option matching
• Custom regex patterns defined by operators

External MCP Validation — For high-stakes fields, delegate validation to an external MCP tool. For example:

• Verify an email domain exists via a validation service
• Check if a company name matches your CRM via a lookup tool
• Validate a postal code against a geography API

External validators can also enrich data — appending company size, industry, or other metadata automatically.

Completeness and Profiles

Every end-user gets a per-bot profile that stores all collected fields and checkpoints. The profile tracks:

• Completeness score — What percentage of required fields have been collected
• Field provenance — Whether each value came from user input, AI inference, or external validation
• Validation history — Which validators passed or failed
• Checkpoint achievements — With timestamps and evidence

This profile data feeds into:

• Audience Segments — Target users by completeness level, specific field values, or achieved checkpoints
• Bot Personalization — The bot tailors responses based on what it knows about the user
• Analytics — Track collection rates, drop-off points, and field-fill trends across your audience

Use Cases

• Lead qualification — Collect company size, budget range, timeline, and use case during a sales conversation
• Patient intake — Gather symptoms, insurance details, and appointment preferences in a healthcare bot
• Customer onboarding — Track progress through setup steps, tutorial completion, and first-action milestones
• Survey replacement — Replace static forms with conversational data collection that feels natural
• Support triage — Collect device model, error codes, and severity before routing to a human agent

Why Build Intelligence Changes Everything

For Individual Developers

You no longer context-switch between your IDE and a web dashboard. Your editor already knows your codebase. Now it knows your Rylvo org too. Describe intent. Let the AI execute.

For Teams

Junior engineers can scaffold production-grade bots with guardrails and knowledge-base connections by describing them in chat. Senior engineers review the generated artifacts instead of writing boilerplate. The team moves faster without sacrificing safety.

For Platform Operators

MCP Hub gives you the governance primitives that keep leadership comfortable: encrypted vaults, approval queues, audit logs, cost tracking, and anomaly detection. You can safely let dozens of developers create bots because the guardrails are automated.

For AI-Native Startups

Build Intelligence is the bridge between "prototype in Cursor" and "deploy on Rylvo." Your AI editor becomes your deployment interface. The loop from idea to running agent shrinks from hours to minutes.

Getting Started

1. Open your AI editor (Claude Code, Cursor, Windsurf, Zed, or Codex CLI).
2. Run the one-line install for your editor.
3. Sign in via OAuth when the browser opens.
4. Start building. Say what you want. Your AI will discover the right tool and call it.

If you are building a custom pipeline, point your model at https://rylvo.com/openapi.json and start function-calling immediately.

FAQ

Which AI editors are supported? Claude Code, Cursor, Windsurf, Zed, and Codex CLI are first-class MCP clients with OAuth handled automatically. Any other function-calling model — OpenAI Responses, Google Gemini, Moonshot Kimi — can connect via the OpenAPI 3.1 spec.

How is authentication handled? OAuth 2.1 with PKCE (S256 only in production). MCP-native clients open the browser flow automatically on first install. Access tokens are RS256 JWTs with a one-hour TTL, bound to exactly one org. Refresh tokens rotate on every exchange.

Is every call scoped to my org? Yes. Every JWT carries an org_id claim that is re-verified on each request against the resource being touched. A token that leaks cannot reach another tenant — the middleware returns 403 before the query runs.

Can I connect without MCP? Yes. The OpenAPI 3.1 spec at /openapi.json documents every endpoint. Point your model's tool loader at it and you get typed tools for the entire Rylvo API.

What do the macro tools do? They compose frequent multi-step operations. scaffold_bot_from_description creates a bot plus system prompt plus starter guardrail from a brief. clone_bot duplicates a bot and optionally its linked resources. attach_mcp_server registers an external server, writes its tool list, and links it to bots — all in one call.

Can bots send proactive messages, not just replies? Yes. Bot Broadcasts let you schedule one-time or recurring outbound messages to targeted audiences across any channel. Use static templates with variable substitution or enable LLM mode for personalized messages per recipient.

Can bots collect structured information from users? Yes. Data Collection lets you define a schema of fields per bot. The bot can explicitly ask users for information or infer it naturally from conversation. Fields support validation, external MCP validators, and enrichment. Checkpoints track milestone completion.

Ready to Hand Your Editor the Keys?

Build Intelligence turns the AI editor you already use into a full Rylvo control plane. One install command. OAuth handles itself. Thirty tools scoped to your org, with every call signed, auditable, and short-lived.

Open Build Intelligence in your dashboard, or read the docs to dive deeper into the MCP Hub architecture.

Happy building.