diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..545c0f4
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,26 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Install dependencies
+        run: npm install
+
+      - name: Build
+        run: npm run build
+
+      - name: Test
+        run: npm test
diff --git a/src/api.ts b/src/api.ts
index 725873a..bcf378b 100644
--- a/src/api.ts
+++ b/src/api.ts
@@ -1,9 +1,16 @@
-// Prefer MOLECULE_URL (the canonical MCP env var), fall back to PLATFORM_URL
-// (what the workspace runtime already injects for heartbeat/register), and
-// only then to localhost:8080. Injecting MOLECULE_URL at container provision
-// is handled by platform/internal/provisioner/provisioner.go; this fallback
-// chain protects older containers and host-side users alike. Fixes #67.
+// Read the platform API base URL from environment.
+// Priority: MOLECULE_API_URL (canonical CLI/SDK env var, per platform docs)
+//
+//   > Required environment variables:
+//   >   MOLECULE_API_URL  — Control plane API base URL
+//   >   MOLECULE_RUNTIME_URL — Workspace runtime URL
+//   >   (per docs/development/constraints-and-rules.md)
+//
+// Fallbacks exist for legacy callers (MOLECULE_URL, PLATFORM_URL) and
+// localhost dev default. Injecting MOLECULE_API_URL at container provision
+// is handled by platform/internal/provisioner/provisioner.go.
 export const PLATFORM_URL =
+  process.env.MOLECULE_API_URL ||
   process.env.MOLECULE_URL ||
   process.env.PLATFORM_URL ||
   "http://localhost:8080";