Start here
The Model Context Protocol server
/v1/mcpon https://api.auray.ai/v1The address to give an agent is https://mcp.auray.ai/mcp, the server's own host since 2026-09-28; this path, where it answered before that, still answers exactly as it does — the same handler, not …
The address to give an agent is https://mcp.auray.ai/mcp, the server's own host since 2026-09-28; this path, where it answered before that, still answers exactly as it does — the same handler, not a redirect — so an agent already configured with https://api.auray.ai/v1/mcp keeps working.
One JSON-RPC 2.0 message per request, answered as JSON, stateless, in both eras of the protocol. Revision 2026-07-28 has no handshake: every request carries _meta with io.modelcontextprotocol/protocolVersion and io.modelcontextprotocol/clientCapabilities, and the headers MCP-Protocol-Version, Mcp-Method and, on tools/call, Mcp-Name mirror the body; its methods are server/discover, tools/list and tools/call, and every result carries resultType. Revisions 2025-03-26, 2025-06-18 and 2025-11-25 open with initialize and answer ping, tools/list and tools/call; a request with no MCP-Protocol-Version header is served as 2025-03-26.
A notification is answered 202 with no body; a request without an id is refused 400 and never run; a response from the client is refused 400 with no id. A batch (an array of up to 20 messages) is answered under 2025-03-26 — no MCP-Protocol-Version header, or that one — as an array, each message admitted against the read bucket like a request of its own, and refused 400 under every other revision. The 2025 revisions are reached through initialize: a 2026-07-28-shaped request naming one of them is refused -32022 naming 2026-07-28, while server/discover lists all four the endpoint serves. Every tool is one call to this API under the key presented, so a tool has exactly the authority the key has, and a tool's failure — the API's refusal with its retry and charged advice, an argument it could not use — is its answer with isError: true. A request carrying an Origin header is refused 403 browser_origin_refused before anything else, with a key or without. GET and DELETE answer 405 with Allow: POST; OPTIONS answers 204 with Allow: POST, or 403 with an Origin.
#Authentication
Authorization: Bearer auray_sk_… — Any key for the protocol itself; each tool carries the scope of the operation it calls, under the same key.
#Request
#Headers
| Name | Type | Required | Description |
|---|---|---|---|
MCP-Protocol-Version | string | no | The revision the request is in. Required by 2026-07-28 and equal to _meta["io.modelcontextprotocol/protocolVersion"]; sent by the 2025 revisions after initialize; absent means 2025-03-26. A revision this server does not serve is refused 400 with -32022, naming the ones it does. The answer echoes the revision served in the same header. One of "2025-03-26", "2025-06-18", "2025-11-25", "2026-07-28". |
Mcp-Method | string | no | Required by 2026-07-28: the body's method, exactly. Missing or different is 400 with -32020. Not read on a 2025 request. |
Mcp-Name | string | no | Required by 2026-07-28 on tools/call: the tool's name, or =?base64?…?= for a name that is not plain ASCII. Missing, undecodable or different from params.name is 400 with -32020. |
#Body
application/json, required.
| Field | Type | Required | Default | Description |
|---|---|---|---|---|
jsonrpc | string | yes | — | One of "2.0". |
id | integer or string | no | — | An integer or a string, never null. Left out only on a notification (notifications/*, answered 202); any other method without one is refused 400 and not run. |
method | string | yes | — | initialize, ping, tools/list and tools/call in the 2025 revisions; server/discover, tools/list and tools/call in 2026-07-28; or a notification, notifications/… (notifications/initialized, notifications/cancelled), which carries no id and is answered 202. |
params | object | no | — | For tools/call: { name, arguments }. For initialize: { protocolVersion, capabilities, clientInfo }. On a 2026-07-28 request, also _meta with io.modelcontextprotocol/protocolVersion and io.modelcontextprotocol/clientCapabilities. |
#Example request
curl -X POST https://api.auray.ai/v1/mcp \
-H "Authorization: Bearer $AURAY_API_KEY" \
-H "content-type: application/json" \
-d '{
"jsonrpc": "2.0",
"id": 1,
"method": "initialize",
"params": {
"protocolVersion": "2025-06-18",
"capabilities": {},
"clientInfo": {
"name": "curl",
"version": "0"
}
}
}'const res = await fetch("https://api.auray.ai/v1/mcp", {
method: "POST",
headers: {
Authorization: `Bearer ${process.env.AURAY_API_KEY}`,
"content-type": "application/json",
},
body: JSON.stringify({
"jsonrpc": "2.0",
"id": 1,
"method": "initialize",
"params": {
"protocolVersion": "2025-06-18",
"capabilities": {},
"clientInfo": {
"name": "curl",
"version": "0"
}
}
}),
});
console.log(await res.json());import os, requests
r = requests.post(
"https://api.auray.ai/v1/mcp",
headers={"Authorization": f"Bearer {os.environ['AURAY_API_KEY']}"},
json={
"jsonrpc": "2.0",
"id": 1,
"method": "initialize",
"params": {
"protocolVersion": "2025-06-18",
"capabilities": {},
"clientInfo": {
"name": "curl",
"version": "0"
}
}
},
)
r.raise_for_status()
print(r.json())package main
import (
"bytes"
"fmt"
"io"
"net/http"
"os"
)
func main() {
body := []byte(`{
"jsonrpc": "2.0",
"id": 1,
"method": "initialize",
"params": {
"protocolVersion": "2025-06-18",
"capabilities": {},
"clientInfo": {
"name": "curl",
"version": "0"
}
}
}`)
req, err := http.NewRequest("POST", "https://api.auray.ai/v1/mcp", bytes.NewReader(body))
if err != nil {
panic(err)
}
req.Header.Set("Authorization", "Bearer "+os.Getenv("AURAY_API_KEY"))
req.Header.Set("Content-Type", "application/json")
res, err := http.DefaultClient.Do(req)
if err != nil {
panic(err)
}
defer res.Body.Close()
out, _ := io.ReadAll(res.Body)
fmt.Println(res.Status, string(out))
}<?php
$ch = curl_init("https://api.auray.ai/v1/mcp");
curl_setopt_array($ch, [
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_HTTPHEADER => [
"Authorization: Bearer " . getenv("AURAY_API_KEY"),
"Content-Type: application/json",
],
CURLOPT_POSTFIELDS => json_encode([
"jsonrpc" => "2.0",
"id" => 1,
"method" => "initialize",
"params" => [
"protocolVersion" => "2025-06-18",
"capabilities" => new \stdClass(),
"clientInfo" => [
"name" => "curl",
"version" => "0",
],
],
], JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE),
]);
$response = curl_exec($ch);
echo curl_getinfo($ch, CURLINFO_HTTP_CODE), " ", $response, PHP_EOL;require "net/http"
require "json"
uri = URI("https://api.auray.ai/v1/mcp")
req = Net::HTTP::Post.new(uri)
req["Authorization"] = "Bearer #{ENV.fetch("AURAY_API_KEY")}"
req["Content-Type"] = "application/json"
req.body = {
"jsonrpc" => "2.0",
"id" => 1,
"method" => "initialize",
"params" => {
"protocolVersion" => "2025-06-18",
"capabilities" => {},
"clientInfo" => {
"name" => "curl",
"version" => "0"
}
}
}.to_json
res = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) { |http| http.request(req) }
puts res.code, res.bodyimport java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
public class Main {
public static void main(String[] args) throws Exception {
String body = """
{
"jsonrpc": "2.0",
"id": 1,
"method": "initialize",
"params": {
"protocolVersion": "2025-06-18",
"capabilities": {},
"clientInfo": {
"name": "curl",
"version": "0"
}
}
}""";
HttpRequest request = HttpRequest.newBuilder()
.uri(URI.create("https://api.auray.ai/v1/mcp"))
.header("Authorization", "Bearer " + System.getenv("AURAY_API_KEY"))
.header("Content-Type", "application/json")
.method("POST", HttpRequest.BodyPublishers.ofString(body))
.build();
HttpResponse<String> response = HttpClient.newHttpClient()
.send(request, HttpResponse.BodyHandlers.ofString());
System.out.println(response.statusCode() + " " + response.body());
}
}using System.Net.Http.Headers;
using System.Text;
using var client = new HttpClient();
client.DefaultRequestHeaders.Authorization =
new AuthenticationHeaderValue("Bearer", Environment.GetEnvironmentVariable("AURAY_API_KEY"));
using var request = new HttpRequestMessage(HttpMethod.Post, "https://api.auray.ai/v1/mcp");
var body = """
{
"jsonrpc": "2.0",
"id": 1,
"method": "initialize",
"params": {
"protocolVersion": "2025-06-18",
"capabilities": {},
"clientInfo": {
"name": "curl",
"version": "0"
}
}
}
""";
request.Content = new StringContent(body, Encoding.UTF8, "application/json");
using var response = await client.SendAsync(request);
Console.WriteLine($"{(int)response.StatusCode} {await response.Content.ReadAsStringAsync()}");#Responses
#200 OK
The JSON-RPC answer: result or error, with the request's id — or, for a 2025-03-26 batch, an array of them. A 2026-07-28 result carries resultType: "complete", and server/discover and tools/list carry ttlMs and cacheScope.
| Field | Type | Required | Default | Description |
|---|---|---|---|---|
jsonrpc | string | yes | — | One of "2.0". |
id | string or integer | yes | — | |
result | object | no | — | |
error | object | no | — | |
error.code | integer | no | — | |
error.message | string | no | — | |
error.data | any | no | — |
Headers:
| Header | Description |
|---|---|
RateLimit-Limit | Burst capacity. |
RateLimit-Remaining | |
RateLimit-Reset | Seconds until refill. |
X-RateLimit-Limit | |
X-RateLimit-Remaining | |
X-RateLimit-Reset | Unix seconds. The X- spelling is what client libraries read. |
X-Request-Id | |
MCP-Protocol-Version | The revision agreed to. |
#202 Accepted
Only notifications were received, and accepted. No body.
#400 Bad Request
A JSON-RPC error, never the API's envelope: -32700 a body that is not JSON, -32600 a batch outside 2025-03-26 (or empty, or over 20 messages), a response from the client, a non-request or a request without an id, -32022 a revision this server does not serve (data: { supported, requested }), -32602 a 2026-07-28 request without its _meta fields, -32020 a header that is missing or does not match the body.
| Field | Type | Required | Default | Description |
|---|---|---|---|---|
jsonrpc | string | yes | — | One of "2.0". |
id | string or integer | no | — | Left out when the request's could not be read. |
error | object | yes | — | |
error.code | integer | yes | — | |
error.message | string | yes | — | |
error.data | any | no | — |
#401 Unauthorized
#403 Forbidden
#404 Not Found
-32601: a method revision 2026-07-28 does not have, ping and initialize included. (A 2025 request is answered -32601 with 200, as those revisions do.)
| Field | Type | Required | Default | Description |
|---|---|---|---|---|
jsonrpc | string | yes | — | One of "2.0". |
id | string or integer | no | — | Left out when the request's could not be read. |
error | object | yes | — | |
error.code | integer | yes | — | |
error.message | string | yes | — | |
error.data | any | no | — |
#413 Payload Too Large
#429 Too Many Requests
#Status codes
| Status | Meaning |
|---|---|
200 | The JSON-RPC answer: result or error, with the request's id — or, for a 2025-03-26 batch, an array of them. |
202 | Only notifications were received, and accepted. |
400 | A JSON-RPC error, never the API's envelope: -32700 a body that is not JSON, -32600 a batch outside 2025-03-26 (or empty, or over 20 messages), a response from the client, a non-request or a request… |
401 | Unauthorized |
403 | Forbidden |
404 | -32601: a method revision 2026-07-28 does not have, ping and initialize included. |
413 | Payload Too Large |
429 | Too Many Requests |
Every refusal names its code, and every code is explained at Errors.