Claude Code Policy: Write Managed Settings Fast
Read More
Enterprise Connectors
Heista logo. Heista MCP server connector.

Heista MCP Server

Decode video ads, load brand intelligence, generate ad scripts.

ToolsTools
70
Last updatedLast Updated
Jun 14, 2026
CategoryCategory
All
Enterprise-grade security
SSO & authentication ready
Full governance & audit logs

What is the Heista MCP Server?

The Heista MCP server gives AI agents structured, permission-aware access to Heista through the Model Context Protocol. With 70 pre-built actions, agents can read, create, and update Heista data on behalf of authorized users.

Willow ships the Heista MCP server as part of an enterprise control plane. Every call runs behind SSO (Okta, Azure AD), enforces RBAC and least-privilege at runtime, writes to a full audit trail, and integrates with Splunk and Loki for SIEM visibility. Connect from Claude Desktop, Claude Code, Cursor, ChatGPT, VS Code, n8n, or any custom agent. Install once, distribute org-wide, and see exactly how Heista is being used by every AI agent in your stack.

Tools

Tool

decode_ad

Decode a specific video ad URL into its full structural formula — beat-by-beat breakdown, hook classification, behavioral psychology stack, creative format, runtime performance signals (active days on Meta Ad Library when available), and per-cut visual data. Takes one video URL plus an optional idempotency_key. Returns a job_id immediately; poll with get_decode every 15s until status is "completed" (typically 45-60s end-to-end). Use this when the user pastes an ad URL, names a specific competitor ad, asks "decode this" or "break down this ad" or "what makes this ad work", or wants sentence-level fidelity to one specific winner before writing a script with generate_adscript. Supports Facebook Ad Library, TikTok, Instagram Reels, YouTube Shorts, and direct .mp4 URLs. Costs 15 credits for videos ≤60s, 20 credits for 61-120s. Do NOT use to browse the corpus or find ads by category — use decoder_intelligence or adformula_intelligence (both free) for discovery. Do NOT use for image ads or static creative.
Tool

get_decode

Retrieve the full decode bundle for a previously-submitted ad, or poll the status of a running decode job. Takes a single job_id (UUID returned by decode_ad). Returns either status="processing" (call again in 15s) or the completed payload — exact transcripts per beat, director's read, per-cut visual data (shot_breakdown), visual psychology, behaviour biases, beat structure, hook classification, and runtime fields (active days on Meta Ad Library when the source supports it). Use this immediately after decode_ad and every 15 seconds until the job completes. Also use this to re-fetch a decode any time you need the full bundle for script writing (Path B) or as the source_id for generate_adscript (source_type="decode"). Free — billing happens at decode_ad submit time, not on retrieval. Do NOT use to discover or list decodes — use decoder_intelligence for browsing. Do NOT use to start a new decode — call decode_ad first.
Tool

create_powersource_url

Build a complete creative intelligence profile of a brand from a single website URL. Takes a website URL (homepage, PDP, landing page) plus optional idempotency_key, force_refresh, and webhook_url. Returns a job_id immediately; poll with get_powersource every 3-5s (typically 60-90s total). The final payload contains 14 structured sections: identity, offer, selling_points, brand_story, brand_style, brand_assets, brand_voice, buyer_profile, 12 buyer tensions, marketing angles, emotional_arcs, ctas, proof_assets, and strategic narrative. Use this when the user says "analyse my brand", "load my brand", "build a strategy from my site", "what should my ads say", "decode this website", or pastes a homepage / competitor URL and wants a brand profile (not an ad decode). Also use this as the brand layer before calling generate_adscript — pass the returned powersource_id. Costs 100 credits. Re-scanning the same URL within your org returns the cached result free. Do NOT use for internal docs / PDFs / brand guidelines — use create_powersource_docs. For URL + docs combined (highest fidelity), use create_powersource_full. Do NOT use to decode a video ad — use decode_ad.
Tool

get_powersource

Retrieve the full creative intelligence profile for a previously-submitted PowerSource scan, or poll the status of a running scan. Takes a job_id (UUID returned by any create_powersource_* tool) plus an optional include_raw flag (admin-only). Returns either status="processing" with partial progress or the completed bundle: brand identity, offer, 12 selling points, brand voice rules, buyer profile, 12 buyer tensions, angles, emotional arcs, ctas, proof, narrative. Use this immediately after any create_powersource_* call and every 3-5 seconds until status is "completed". During synthesis, partial intelligence appears progressively (buyer archetype first, then tensions, then angles) — inspect each poll response, useful signal arrives early. Also use this to re-fetch a finished PowerSource any time you need the brand layer for downstream work. Free — billing happens at submit time. Do NOT use to start a new scan — call create_powersource_url, _docs, or _full first. Do NOT use to retrieve a video decode — use get_decode.
Tool

create_powersource_docs

Build a complete creative intelligence profile from internal brand documents — creative briefs, brand guidelines, product specs, customer research, competitive analysis. Takes any mix of file_ids (from a previous upload), document_urls (public PDF/DOCX/TXT/MD links, up to 10), or documents_inline (base64-encoded files with filename), plus an optional context_url for layering live brand context (colors, fonts, current messaging) and optional idempotency_key. Returns a job_id; poll with get_powersource. Output shape is identical to create_powersource_url: identity, offer, selling points, voice, buyer profile, tensions, angles, emotional arcs, ctas, narrative. Use this when the user says "I have a brief", "here's my brand guidelines", "use this document", drops a PDF / DOCX / strategy deck, or when the truth lives in internal materials rather than the public website. The pipeline reads text only — convert PDFs to markdown before submitting via documents_inline when possible. Costs 100 credits. Do NOT use for URL-only scans — use create_powersource_url. For URL + docs combined (highest fidelity, triangulates public messaging against internal strategy), use create_powersource_full.
Tool

create_powersource_full

Build the highest-fidelity creative intelligence profile by combining a brand's public website URL with their internal documents. Takes a required website URL plus at least one document — file_ids from previous upload, public document_urls (PDF/DOCX/TXT/MD, up to 10), or documents_inline (base64-encoded). Optional idempotency_key for safe retry. Returns a job_id; poll with get_powersource. Same response shape as create_powersource_url, but the synthesis cross-checks how the brand presents publicly against what the team actually believes internally, producing stronger conviction on voice, positioning, proof, and tension architecture than either input alone. Use this when the user has both a public site AND a brief / brand guidelines / strategy deck and wants the deepest possible profile — the kind of intelligence a senior strategist produces over a week. Default recommendation when both inputs are available. Costs 200 credits. Do NOT use for URL-only scans — use create_powersource_url (100 credits). Do NOT use for docs-only scans — use create_powersource_docs (100 credits).
Tool

check_balance

Check the calling user's Heista API credit balance, month-to-date usage broken down by operation, lifetime spend, and the current pricing for every paid tool. Takes no inputs. Returns balance in cents, lifetime spend in cents, month-to-date call counts per tool (decode_ad, create_powersource_*, generate_adscript), per-tool unit pricing, and a top-up link the user can follow to add credits. Free, read-only, idempotent. Use this whenever the user asks about credits, balance, usage, how much they've spent, top-ups, pricing, "what does this cost", or "how many credits do I have". This is also the ONLY surface where dollar amounts are legitimate to report in conversation — everywhere else, cost should be referenced in credits, not currency. Do NOT use to add credits or change billing — only to read state. Do NOT call this on every turn — invoke once when the user explicitly asks about account state.
Tool

get_hook_intelligence

Browse proven hook patterns from Heista's corpus of decoded winning Meta/TikTok ads. Takes optional filters: vertical (e.g. BEAUTY_SKINCARE, SUPPLEMENTS, APPAREL), hook_type (e.g. CURIOSITY_SPIKE, CONTRADICTION, CALLOUT), and marketing_angle. Returns hook examples (the real opener lines from successful ads), pattern templates, the psychological mechanism behind why each one stops the scroll within the first 1.5 seconds, and runtime performance data (active days on Meta when available). Free, read-only, idempotent — no credits consumed. Use this when the user asks "what hooks stop the scroll", "give me hook ideas", "how should I open this ad", "show me hooks for [vertical]", or needs scroll-stopping openers grounded in proven patterns rather than guessed copy. Useful before writing a script — pair with adformula_intelligence or decoder_intelligence for the full beat structure. Do NOT use to decode a specific ad URL — use decode_ad. Do NOT use to generate finished scripts — use generate_adscript. Hooks here are pattern intelligence, not finished copy.
Tool

adformula_intelligence

Browse proven ad formula blueprints — structural patterns clustered from 3-10+ winning ads that independently converged on the same beat architecture while Meta kept rewarding them with sustained spend. Takes optional filters: vertical, creative_format (e.g. TALKING_HEAD, UGC, FOUNDER_STORY), marketing_angle, algo_intent, hook_type, and limit (1-10, default 5). Each formula returns: source ad count, average active days (runtime proof), confidence score, 6-layer beat blueprint, per-beat visual direction, marketing angle, psychology mission. Free, read-only, idempotent. Use this when the user asks "what's working in [category]", "show me formulas for talking-head ads", "what scripts work in my vertical", or wants category-level pattern discovery before committing to a single ad. Pass the returned formula id to generate_adscript with source_type="formula" for synthesis. When choosing among results: prioritise (1) avg_active_days as primary proof, (2) marketing_angle alignment with the brand's buyer tension, (3) source_ad_count for cluster robustness, (4) confidence_score as tiebreaker. Do NOT use when the user names a specific ad — decode that ad with decode_ad. Do NOT use for sentence-level transcript fidelity — formulas abstract the structure, not exact copy.
Tool

decoder_intelligence

Browse individual decoded ads from Heista's corpus of real winning Meta/TikTok creative. Takes optional filters: vertical, creative_format, marketing_angle, hook_type, algo_intent, brand (partial name match), and limit (1-10, default 5). Each result returns beat timeline, classification, psychology, runtime performance signals (active days on Meta when available), and a decode id you can pass into generate_adscript with source_type="decode" to write a fresh script on that exact structure. Free, read-only, idempotent — no credits consumed. Use this when the user wants a specific ad as a script template (not an averaged formula), asks "show me winning ads in [vertical]", "what are [brand]'s top ads", or wants to see examples before committing to a generation. Source discovery surface — the response is the spine; for the full bundle with transcripts and director's read, call get_decode by id afterwards. Do NOT use to decode a NEW ad from a URL — use decode_ad (paid). Do NOT use for category-level patterns abstracted across multiple ads — use adformula_intelligence. Do NOT use to write the script itself — use generate_adscript or write directly from the bundle.
...
1–10 of 70 tools
Customize tools

Customize Tools

Edit descriptions, modify arguments, select tools, or add new ones

ReviewEdit descriptions
ConfigureChange arguments
ApproveSelect tools
Create NewAdd tool

Set Up Your Heista MCP Server in Minutes

Add the following configuration to your MCP client. Authentication is handled via OAuth. Compatible with Claude Desktop, Claude Code, Cursor, ChatGPT, VS Code, n8n, and any MCP-compatible agent.

Claude Desktop

claude_desktop_config.json
{
  "mcpServers": {
    "willow-heista": {
      "type": "http",
      "url": "https://<org>.mcp-s.com/mcp/mcp/heista"
    }
  }
}

Cursor

.cursor/mcp.json
{
  "mcpServers": {
    "willow-heista": {
      "type": "http",
      "url": "https://<org>.mcp-s.com/mcp/mcp/heista"
    }
  }
}

Claude Code

CLI
claude mcp add willow-heista --transport http https://<org>.mcp-s.com/mcp/mcp/heista

n8n

HTTP Request Node
{
  "url": "https://<org>.mcp-s.com/mcp/mcp/heista",
  "method": "POST"
}

Or click "Install with Willow" above to set up automatically with SSO and RBAC preconfigured.

Enterprise Governance for Heista

Willow adds the layer Heista and every other SaaS doesn't ship out of the box: every call runs behind SSO (Okta, Azure AD), enforces RBAC and least-privilege at runtime, writes to full audit logs, and detects shadow AI usage across your stack. One MCP gateway. Any agent. Every tool.

Heista MCP Server FAQ

What is the Heista MCP server?

The Heista MCP server is a Model Context Protocol implementation that lets AI agents like Claude, Cursor, and ChatGPT read and write Heista data through a standardized interface. Willow hosts and governs this server so enterprises can roll it out without a security review backlog.

How is Willow's Heista MCP server different from the official one?

The official Heista MCP server is scoped to a single user's account and does not include enterprise governance. Willow's version adds SSO, RBAC, audit logging, shadow AI detection, and centralized control over which actions agents can take across the entire org.

Which AI clients work with the Heista MCP server?

Claude Desktop, Claude Code, Cursor, ChatGPT, VS Code with MCP support, n8n, and any custom agent built with OpenAI Agents SDK, LangChain, Vercel AI SDK, or Anthropic SDK.

Is the Heista MCP server secure? How does Willow handle authentication?

Every call runs behind your existing SSO (Okta, Azure AD). Per-user OAuth scopes the agent to exactly what that user can do in Heista, nothing more. No credentials reach the LLM. Every action writes to an audit trail.

Can I limit which Heista actions agents can take?

Yes. Willow lets you scope agents to specific actions, specific projects, or specific environments. Toggle actions on or off in the dashboard, or enforce policy via infrastructure-as-code through GitHub.

How do I detect shadow Heista MCP servers in my org?

Willow's browser extension and discovery service surface unmanaged MCP servers, skills, and AI agents across the org. If a developer installed an unapproved Heista MCP locally, you'll see it.

What does the Heista MCP server cost?

Pricing depends on org size and deployment model (SaaS, dedicated cloud, self-host). See withwillow.ai/pricing or contact sales for a quote.

How do I install the Heista MCP server with Willow?

Install via the Willow Connect Panel in one click, or paste the JSON snippet above into your Claude Desktop, Cursor, or Claude Code config. SSO and RBAC inherit from your existing Willow setup.

Compare Willow MCP Gateway

See how Willow stacks up against other MCP platforms on governance, security, and enterprise readiness.

Your agents are already in the wild.

Give them a Basecamp. Go from AI chaos to AI work, in minutes.

Heista MCP Server | Willow