POST /mcp
api-reference / v1
Operation projection
Stateless read-only MCP JSON-RPC transport Requires application/json, Accept: application/json, text/event-stream and MCP-Protocol-Version. Body is bounded to 64 KiB. Signed tools supply per-tool inputSchema and outputSchema. Tool calls never execute writes.
Full operation schema
{
"operationId": "mcp",
"summary": "Stateless read-only MCP JSON-RPC transport",
"security": [
{
"bearer": []
}
],
"description": "Requires application/json, Accept: application/json, text/event-stream and MCP-Protocol-Version. Body is bounded to 64 KiB. Signed tools supply per-tool inputSchema and outputSchema. Tool calls never execute writes.",
"requestBody": {
"required": true,
"content": {
"application/json": {
"schema": {
"type": "object",
"description": "MCP JSON-RPC request; consult the negotiated MCP protocol for method-specific fields.",
"properties": {
"jsonrpc": {
"const": "2.0"
},
"id": {
"type": [
"string",
"integer"
],
"minimum": -9007199254740991,
"maximum": 9007199254740991
},
"method": {
"type": "string"
},
"params": {
"type": "object"
}
},
"required": [
"jsonrpc",
"method"
]
}
}
}
},
"responses": {
"200": {
"description": "MCP JSON-RPC response; tool failures use isError within the result."
},
"202": {
"description": "Accepted MCP notification; no response body."
},
"400": {
"description": "Invalid MCP request"
},
"401": {
"description": "Unauthorized"
},
"403": {
"description": "Host or browser origin refused"
},
"406": {
"description": "Required Accept types missing"
},
"413": {
"description": "Request exceeds 64 KiB"
},
"503": {
"description": "Authorization or transport unavailable"
}
}
}Request fields
JSON properties and constraints projected from requestBody.content.application/json.schema.
| Field | Schema | Presence |
|---|---|---|
| jsonrpc | {"const":"2.0"} | Required |
| id | {"type":["string","integer"],"minimum":-9007199254740991,"maximum":9007199254740991} | Optional |
| method | {"type":"string"} | Required |
| params | {"type":"object"} | Optional |
Responses
Status-specific responses from the published operation.
| HTTP | Definition |
|---|---|
| 200 | {"description":"MCP JSON-RPC response; tool failures use isError within the result."} |
| 202 | {"description":"Accepted MCP notification; no response body."} |
| 400 | {"description":"Invalid MCP request"} |
| 401 | {"description":"Unauthorized"} |
| 403 | {"description":"Host or browser origin refused"} |
| 406 | {"description":"Required Accept types missing"} |
| 413 | {"description":"Request exceeds 64 KiB"} |
| 503 | {"description":"Authorization or transport unavailable"} |
Authentication and errors
Credentials and runtime policy have distinct owners. The surface uses MCP transport errors; the guard runtime taxonomy is separate.