/api/mcp
The Model Context Protocol server endpoint.
A single route, /api/mcp, serves the entire MCP server over a stateless Streamable HTTP
transport, no SSE, no session affinity. GET, POST, and DELETE all funnel into the same
handler; see MCP → Route & transport for the full detail (the
transport class, why it's stateless, and how project context gets hydrated per call rather than
per connection).
Auth is the same verifyHandoffApiAuth() path described in Auth & scopes
— a sync bearer or an OAuth JWT, with per-tool scope checks happening inside individual tool
handlers rather than at the route level. See MCP → Authentication for the two
run-mode behaviors (open by default in workspace mode, required in registry mode) and both OAuth
flows that can obtain a token.
The full tool surface, every tool, grouped by category, with its purpose and required scope, is documented in the MCP pillar, not duplicated here.