Docs

Start here

The Model Context Protocol server

POST/v1/mcpon https://api.auray.ai/v1

The address to give an agent is https://mcp.auray.ai/mcp, the server's own host since 2026-09-28; this path, where it answered before that, still answers exactly as it does — the same handler, not …

The address to give an agent is https://mcp.auray.ai/mcp, the server's own host since 2026-09-28; this path, where it answered before that, still answers exactly as it does — the same handler, not a redirect — so an agent already configured with https://api.auray.ai/v1/mcp keeps working.

One JSON-RPC 2.0 message per request, answered as JSON, stateless, in both eras of the protocol. Revision 2026-07-28 has no handshake: every request carries _meta with io.modelcontextprotocol/protocolVersion and io.modelcontextprotocol/clientCapabilities, and the headers MCP-Protocol-Version, Mcp-Method and, on tools/call, Mcp-Name mirror the body; its methods are server/discover, tools/list and tools/call, and every result carries resultType. Revisions 2025-03-26, 2025-06-18 and 2025-11-25 open with initialize and answer ping, tools/list and tools/call; a request with no MCP-Protocol-Version header is served as 2025-03-26.

A notification is answered 202 with no body; a request without an id is refused 400 and never run; a response from the client is refused 400 with no id. A batch (an array of up to 20 messages) is answered under 2025-03-26 — no MCP-Protocol-Version header, or that one — as an array, each message admitted against the read bucket like a request of its own, and refused 400 under every other revision. The 2025 revisions are reached through initialize: a 2026-07-28-shaped request naming one of them is refused -32022 naming 2026-07-28, while server/discover lists all four the endpoint serves. Every tool is one call to this API under the key presented, so a tool has exactly the authority the key has, and a tool's failure — the API's refusal with its retry and charged advice, an argument it could not use — is its answer with isError: true. A request carrying an Origin header is refused 403 browser_origin_refused before anything else, with a key or without. GET and DELETE answer 405 with Allow: POST; OPTIONS answers 204 with Allow: POST, or 403 with an Origin.

#Authentication

Authorization: Bearer auray_sk_… — Any key for the protocol itself; each tool carries the scope of the operation it calls, under the same key.

#Request

#Headers

NameTypeRequiredDescription
MCP-Protocol-VersionstringnoThe revision the request is in. Required by 2026-07-28 and equal to _meta["io.modelcontextprotocol/protocolVersion"]; sent by the 2025 revisions after initialize; absent means 2025-03-26. A revision this server does not serve is refused 400 with -32022, naming the ones it does. The answer echoes the revision served in the same header. One of "2025-03-26", "2025-06-18", "2025-11-25", "2026-07-28".
Mcp-MethodstringnoRequired by 2026-07-28: the body's method, exactly. Missing or different is 400 with -32020. Not read on a 2025 request.
Mcp-NamestringnoRequired by 2026-07-28 on tools/call: the tool's name, or =?base64?…?= for a name that is not plain ASCII. Missing, undecodable or different from params.name is 400 with -32020.

#Body

application/json, required.

FieldTypeRequiredDefaultDescription
jsonrpcstringyes—One of "2.0".
idinteger or stringno—An integer or a string, never null. Left out only on a notification (notifications/*, answered 202); any other method without one is refused 400 and not run.
methodstringyes—initialize, ping, tools/list and tools/call in the 2025 revisions; server/discover, tools/list and tools/call in 2026-07-28; or a notification, notifications/… (notifications/initialized, notifications/cancelled), which carries no id and is answered 202.
paramsobjectno—For tools/call: { name, arguments }. For initialize: { protocolVersion, capabilities, clientInfo }. On a 2026-07-28 request, also _meta with io.modelcontextprotocol/protocolVersion and io.modelcontextprotocol/clientCapabilities.

#Example request

curl -X POST https://api.auray.ai/v1/mcp \
  -H "Authorization: Bearer $AURAY_API_KEY" \
  -H "content-type: application/json" \
  -d '{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "initialize",
  "params": {
    "protocolVersion": "2025-06-18",
    "capabilities": {},
    "clientInfo": {
      "name": "curl",
      "version": "0"
    }
  }
}'

#Responses

#200 OK

The JSON-RPC answer: result or error, with the request's id — or, for a 2025-03-26 batch, an array of them. A 2026-07-28 result carries resultType: "complete", and server/discover and tools/list carry ttlMs and cacheScope.

FieldTypeRequiredDefaultDescription
jsonrpcstringyes—One of "2.0".
idstring or integeryes—
resultobjectno—
errorobjectno—
error.codeintegerno—
error.messagestringno—
error.dataanyno—

Headers:

HeaderDescription
RateLimit-LimitBurst capacity.
RateLimit-Remaining
RateLimit-ResetSeconds until refill.
X-RateLimit-Limit
X-RateLimit-Remaining
X-RateLimit-ResetUnix seconds. The X- spelling is what client libraries read.
X-Request-Id
MCP-Protocol-VersionThe revision agreed to.

#202 Accepted

Only notifications were received, and accepted. No body.

#400 Bad Request

A JSON-RPC error, never the API's envelope: -32700 a body that is not JSON, -32600 a batch outside 2025-03-26 (or empty, or over 20 messages), a response from the client, a non-request or a request without an id, -32022 a revision this server does not serve (data: { supported, requested }), -32602 a 2026-07-28 request without its _meta fields, -32020 a header that is missing or does not match the body.

FieldTypeRequiredDefaultDescription
jsonrpcstringyes—One of "2.0".
idstring or integerno—Left out when the request's could not be read.
errorobjectyes—
error.codeintegeryes—
error.messagestringyes—
error.dataanyno—

#401 Unauthorized

#403 Forbidden

#404 Not Found

-32601: a method revision 2026-07-28 does not have, ping and initialize included. (A 2025 request is answered -32601 with 200, as those revisions do.)

FieldTypeRequiredDefaultDescription
jsonrpcstringyes—One of "2.0".
idstring or integerno—Left out when the request's could not be read.
errorobjectyes—
error.codeintegeryes—
error.messagestringyes—
error.dataanyno—

#413 Payload Too Large

#429 Too Many Requests

#Status codes

StatusMeaning
200The JSON-RPC answer: result or error, with the request's id — or, for a 2025-03-26 batch, an array of them.
202Only notifications were received, and accepted.
400A JSON-RPC error, never the API's envelope: -32700 a body that is not JSON, -32600 a batch outside 2025-03-26 (or empty, or over 20 messages), a response from the client, a non-request or a request…
401Unauthorized
403Forbidden
404-32601: a method revision 2026-07-28 does not have, ping and initialize included.
413Payload Too Large
429Too Many Requests

Every refusal names its code, and every code is explained at Errors.

Start typing to search every page of the documentation.

Up arrow Down arrow to moveEnter to openEscape to close