MCP endpoint and authentication¶

Endpoint¶

https://mcp.heyaira.eu/mcp

Transport: MCP Streamable HTTP.

MCP tools are discovered through tools/list and invoked through /mcp. They are not independent REST endpoints.

The machine-readable HTTP contract is the OpenAPI 3.1 document, and the generated MCP tool snapshot is available in the machine-readable contracts reference. OpenAPI describes the HTTP/OAuth surface; MCP tools/list remains authoritative for tool schemas.

Public authentication¶

Public clients use OAuth 2.1 Authorization Code with PKCE. The server exposes protected-resource and authorization-server metadata so a client can discover the flow. The resource identifier is:

https://mcp.heyaira.eu/mcp

Internal compatibility clients may use a project-scoped Bearer credential. Neither credential may be committed to Git or written into documentation.

Read-only first¶

Before a mutation, call server_identity and continuity_context. A client with a stale schema must reconnect and rediscover tools. It must not remove required fields or fall back to an unbound write path.

Operational endpoints¶

/healthz — shallow liveness check;
/docs — compact service-facing documentation;
/ — service identity page;
/.well-known/oauth-protected-resource/mcp — protected-resource metadata;
/.well-known/oauth-authorization-server — authorization-server metadata.