Skip to content
Pre-alpha / current reality

Pre-alpha. Detection is off until you configure it. SDKs are unpublished. The hosted service is not available yet. Nothing has run against production traffic.

POST /mcp

api-reference / v1

Operation projection

Stateless read-only MCP JSON-RPC transport Requires application/json, Accept: application/json, text/event-stream and MCP-Protocol-Version. Body is bounded to 64 KiB. Signed tools supply per-tool inputSchema and outputSchema. Tool calls never execute writes.

Full operation schema
{
  "operationId": "mcp",
  "summary": "Stateless read-only MCP JSON-RPC transport",
  "security": [
    {
      "bearer": []
    }
  ],
  "description": "Requires application/json, Accept: application/json, text/event-stream and MCP-Protocol-Version. Body is bounded to 64 KiB. Signed tools supply per-tool inputSchema and outputSchema. Tool calls never execute writes.",
  "requestBody": {
    "required": true,
    "content": {
      "application/json": {
        "schema": {
          "type": "object",
          "description": "MCP JSON-RPC request; consult the negotiated MCP protocol for method-specific fields.",
          "properties": {
            "jsonrpc": {
              "const": "2.0"
            },
            "id": {
              "type": [
                "string",
                "integer"
              ],
              "minimum": -9007199254740991,
              "maximum": 9007199254740991
            },
            "method": {
              "type": "string"
            },
            "params": {
              "type": "object"
            }
          },
          "required": [
            "jsonrpc",
            "method"
          ]
        }
      }
    }
  },
  "responses": {
    "200": {
      "description": "MCP JSON-RPC response; tool failures use isError within the result."
    },
    "202": {
      "description": "Accepted MCP notification; no response body."
    },
    "400": {
      "description": "Invalid MCP request"
    },
    "401": {
      "description": "Unauthorized"
    },
    "403": {
      "description": "Host or browser origin refused"
    },
    "406": {
      "description": "Required Accept types missing"
    },
    "413": {
      "description": "Request exceeds 64 KiB"
    },
    "503": {
      "description": "Authorization or transport unavailable"
    }
  }
}

Request fields

JSON properties and constraints projected from requestBody.content.application/json.schema.

FieldSchemaPresence
jsonrpc{"const":"2.0"}Required
id{"type":["string","integer"],"minimum":-9007199254740991,"maximum":9007199254740991}Optional
method{"type":"string"}Required
params{"type":"object"}Optional

Responses

Status-specific responses from the published operation.

HTTPDefinition
200{"description":"MCP JSON-RPC response; tool failures use isError within the result."}
202{"description":"Accepted MCP notification; no response body."}
400{"description":"Invalid MCP request"}
401{"description":"Unauthorized"}
403{"description":"Host or browser origin refused"}
406{"description":"Required Accept types missing"}
413{"description":"Request exceeds 64 KiB"}
503{"description":"Authorization or transport unavailable"}

Authentication and errors

Credentials and runtime policy have distinct owners. The surface uses MCP transport errors; the guard runtime taxonomy is separate.