---
title: "Authenticated MCP server (Streamable HTTP)"
method: POST
path: "/mcp"
tags: ["MCP"]
---

# Authenticated MCP server (Streamable HTTP)

`POST /mcp`

## Request

- Base URL: `https://aiagent.app`
- URL: `https://aiagent.app/mcp`
- Auth: OAuth 2
  - Authorization code: `https://aiagent.app/api/auth/oauth2/authorize`
  - Token URL: `https://aiagent.app/api/auth/oauth2/token`

MCP server for acting in the signed-in user's workspaces, with that user's permissions. POST only. Requires an OAuth 2.1 access token issued for the resource https://aiagent.app/mcp; discover the authorization server from the RFC 9728 metadata at https://aiagent.app/.well-known/oauth-protected-resource/mcp.

## Response `200`

Streamable HTTP JSON-RPC transport

- object

## Other responses

- `401`: Missing, invalid, or expired access token. The Bearer challenge's resource_metadata points at the protected-resource metadata.
- `403`: The token lacks the scope a tool needs. The insufficient_scope Bearer challenge names the scopes to request on re-authorization.

---

[API](https://skmtc.dev/aiagent/apis/ai-agent-public-discovery-api.md) - [All operations](https://skmtc.dev/aiagent/apis/ai-agent-public-discovery-api/llms.txt) - [OpenAPI document](https://skmtc.dev/aiagent/apis/ai-agent-public-discovery-api/revisions/31c49d91cbd7?raw)