MCP Streamable HTTP endpoint

POST

/mcp

curl --request POST \
  --url https://example.com/api/v1/mcp \
  --header 'Content-Type: application/json' \
  --data '{}'

• API v1

Model Context Protocol (MCP) endpoint over Streamable HTTP, stateless. The request body is a single JSON-RPC 2.0 request or notification: a request returns a single JSON-RPC response, a notification returns 202 with no body. The tool/resource/prompt surface is discovered at runtime via tools/list, resources/list, and prompts/list rather than modeled here.

Read-only: exposes Praxrr’s configuration and observability surface (instances, drift, config health, security posture, PCD databases and resolved entities, sync history, and the redacted feature-aware list_plugins tool) plus a write-free preview_sync. list_plugins exposes no plugin source directory, raw manifest, credential, or mutation handler. Authenticate with the X-Api-Key header (required under AUTH=on); there is no OAuth/Bearer support. Disabled (404) when MCP_ENABLED is off.

Parameters

Header Parameters

X-Api-Key

string

Praxrr API key. Required for non-browser clients under AUTH=on.

MCP-Protocol-Version

string

Negotiated MCP protocol version. An unsupported value returns 400.

Request Body^required

Media typeapplication/json

A single JSON-RPC 2.0 request or notification object.

object

key

additional properties

any

Example^generated

{}

Responses

200

A single JSON-RPC 2.0 response object.

Media typeapplication/json

A single JSON-RPC 2.0 response object (result or error).

object

key

additional properties

any

Example^generated

{}

202

A JSON-RPC notification was accepted; no response body.

400

Unsupported MCP-Protocol-Version header.

Media typeapplication/json

object

error

required

Error message

string

Example^generated

{
  "error": "example"
}

401

Unauthenticated (missing or invalid API key).

403

Rejected cross-origin request (DNS-rebinding defense).

404

The MCP endpoint is disabled (MCP_ENABLED is off).

413

Request body too large.