---
title: "Remote MCP endpoint (JSON-RPC)"
method: POST
path: "/api/v1/mcp"
tags: ["MCP"]
---

# Remote MCP endpoint (JSON-RPC)

`POST /api/v1/mcp`

Model Context Protocol (MCP) Streamable HTTP transport. Accepts a JSON-RPC 2.0 request and returns a JSON-RPC response. Supported methods: initialize, notifications/initialized, ping, tools/list, tools/call. Remote MCP exposes 29 read-only tools for public V1 read operations: get_leaderboard, get_trader, batch_get_traders, get_whale_trades, get_whale_trade, get_whale_trades_history, get_market_intel, batch_get_market_intel, get_smart_money_flows, get_market_snapshot, get_insider_radar, get_insider_radar_flag, get_positions, get_position_timeline, get_position_timeline_by_id, search_markets, explore_markets, get_event_replay_since, list_webhooks, get_webhook, get_daily_report_snapshot, get_weekly_report_snapshot, get_monthly_report_snapshot, get_report, get_trader_export_snapshot, get_platforms, get_large_positions, get_trending_wallets, get_trader_pnl. Webhook create/update/delete/verify/rotate operations are intentionally not exposed as remote MCP tools. The remote endpoint advertises tools only; it does not implement resources/list, resources/read, prompts/list, or prompts/get. Each tool dispatches to the matching /api/v1/* handler in-process so auth, rate limits, and payload shape match. Auth should use Authorization: Bearer <token>. ?token=<token> remains a legacy compatibility path for URL-only MCP clients, but URL secrets can land in shell history, browser history, and logs, so prefer headers or the stdio package. Mcp-Session-Id is minted on initialize and echoed on every response. Origin header, when present, is validated against the 0xinsider + localhost allowlist.

## Query parameters

- `token` string

## Headers

- `Mcp-Session-Id` string

## Request body

- object
  - `jsonrpc` '2.0', required
  - `id` union
    - string
    - number
  - `method` 'initialize' | 'notifications/initialized' | 'ping' | 'tools/list' | 'tools/call', required
  - `params` object

## Response `200`

JSON-RPC response

- object
  - `jsonrpc` '2.0', required
  - `id` union, required
    - string
    - number
  - `result` object
  - `error` object
    - `code` integer, required
    - `message` string, required

## Other responses

- `202` — Notification acknowledged (no body)
- `400` — JSON-RPC parse or invalid-request error
- `401` — Missing or invalid API key
- `402` — Active Insider subscription required
- `403` — Origin rejected or tier forbidden
- `429` — Rate limit exceeded (100 req/min; batch endpoints also reserve 100 batch item units/min before execution)
- `500` — Unexpected server error

## Changes

- **2026-06-01** `422bd4dc1611` — 36 warning, 1 info
  - added the new `account_locked` enum value to the `error/code` response property for the response status `401`
  - added the new `account_locked` enum value to the `error/code` response property for the response status `402`
  - added the new `account_locked` enum value to the `error/code` response property for the response status `429`
  - added the new `account_locked` enum value to the `error/code` response property for the response status `500`
  - …33 more
- **2026-05-07** `2907497f4ca3` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/0xinsider/apis/0xinsider-api/changes/api/v1/mcp/post.md)

---

[API](https://skmtc.dev/0xinsider/apis/0xinsider-api.md) · [All operations](https://skmtc.dev/0xinsider/apis/0xinsider-api/llms.txt) · [OpenAPI document](https://skmtc.dev/0xinsider/apis/0xinsider-api/revisions/137fa0fd3297?raw)