MCP Endpoints

Endpoint Map

Flexible auth supports JWT, gk_ API key (+ JWT or X-User-Id), and art_ runtime token.

Unified MCP (/api/v1/mcp/mcp)

Supported JSON-RPC methods:

• initialize
• notifications/initialized
• tools/list
• tools/call
• ping

Optional query parameter:

• providers=id1,id2 to constrain tool listing/calling to specific providers

Example: tools/list

POST /api/v1/mcp/mcp
Authorization: Bearer <jwt>
Content-Type: application/json

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/list",
  "params": {}
}

Example: tools/call

POST /api/v1/mcp/mcp
X-Api-Key: gk_xxx
X-Agent-Id: <agent-id>
X-User-Id: <end-user-id>
Content-Type: application/json

{
  "jsonrpc": "2.0",
  "id": 2,
  "method": "tools/call",
  "params": {
    "name": "slack_send_message",
    "arguments": { "channel": "#ops", "text": "hello" }
  }
}

Per-Provider MCP Proxy (/api/v1/mcp-proxy/:providerId/mcp)

Use this when the caller already knows the provider.

• Same Streamable HTTP transport behavior (POST/GET/DELETE)
• Same policy pipeline for tools/call
• Provider-level ACL is checked before forwarding

Policy Behavior for tools/call

1. Provider access ACL check
2. Tool policy evaluation
3. Decision:
   • allow: forwarded upstream
   • deny: JSON-RPC error returned (403)
   • require_confirmation: connection held until confirmation resolves

Session Headers

For Streamable HTTP sessions, send/receive Mcp-Session-Id.