Skip to content
SlooseSloose

Remote MCP endpoint (Streamable HTTP)

POST
/mcp
curl --request POST \
  --url https://api.sloose.com/mcp \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{}'

A Model Context Protocol server, so an agent can read your schema and write projects under the same rules the widget follows — a gate the widget honours and this does not would not be a gate.

Stateless: each request builds a server scoped to the bearer’s org and tears it down again.

Getting a token. This API is an OAuth 2.1 authorisation server for MCP clients: point a client at this URL with no token and the 401 carries the RFC 9728 challenge naming /.well-known/oauth-protected-resource/mcp, from which the client discovers /.well-known/oauth-authorization-server, its authorisation and token endpoints, and that it may register by Client ID Metadata Document (its client id is the HTTPS URL of a JSON document describing it — no manual registration, no dynamic registration). The person signs in on the account app, chooses which org the client may use, and consents; the access token is a JWT bound to this resource and to that org, and works here at the role the person holds in the org for as long as they hold it. A session token or an org API token still work as bearers too.

Tools

  • list_modules — the org’s enabled modules and their vocabulary
  • get_fields — a module’s fields and annotations; long picklists sampled, searchable by option
  • propose_mapping — a validated mapping proposal for a set of columns
  • test_expression — compile and run an expression against sample rows
  • validate_project — check a project configuration without saving it
  • list_projects — projects visible to the caller
  • get_project — one project, migrated to the current schema
  • save_project — create or update a project

The request and response bodies are JSON-RPC envelopes defined by the MCP specification, not by this document. The specification also uses GET (to open a stream) and DELETE (to end a session) on this same path; both are served, but only POST is described here, because OpenAPI 3.1 cannot say “any method” and a GET operation carrying a JSON-RPC body would not be true.

Authorizations

Section titled “Authorizations”

Request Bodyrequired

Section titled “Request Bodyrequired”

A JSON-RPC request.

Media typeapplication/json

A JSON-RPC request, per the MCP specification.

object
Examplegenerated
{}

Responses

Section titled “Responses”

200

Section titled “200”

The tool result.

Media typeapplication/json

A JSON-RPC response, per the MCP specification.

object
Examplegenerated
{}

401

Section titled “401”

No bearer, or one that is expired, revoked or no longer resolves to a member. Carries WWW-Authenticate: Bearer resource_metadata="…/.well-known/oauth-protected-resource/mcp", the RFC 9728 challenge an MCP client starts its authorisation from.

403

Section titled “403”

A good OAuth token that may not act here: not granted the mcp scope (INSUFFICIENT_SCOPE), no longer a member of the org (NOT_A_MEMBER), access revoked (ACCESS_REVOKED), or suspended (BANNED).

404

Section titled “404”

The bearer’s org no longer exists.