---
title: "Authenticated MCP welcome"
method: GET
path: "/mcp-bot"
tags: ["MCP"]
---

# Authenticated MCP welcome

`GET /mcp-bot`

## Request

- Base URL: `https://api.apphandoff.com/api`
- URL: `https://api.apphandoff.com/api/mcp-bot`
- Auth: HTTP bearer

A verified bearer returns the welcome JSON (server name, version, and the canonical MCP endpoint). Every unauthenticated GET is 401 with WWW-Authenticate pointing at the canonical `/.well-known/oauth-protected-resource/mcp` metadata. A 200 welcome page is not that document. An authenticated GET with `Accept: text/event-stream` is 405; there is no standalone SSE stream.

## Response `200`

Authenticated welcome JSON

- object
  - `ok` true, required
  - `data` object, required
    - `name` string, required
    - `version` string, required
    - `protocol` string, required
    - `auth_required` false, required
    - `tools_available_after_auth` boolean
    - `discovery` object, required
      - `next_step` string, required
      - `endpoint` string, uri, required

## Other responses

- `401`: No usable bearer. WWW-Authenticate is a Bearer challenge whose resource_metadata parameter is the canonical protected-resource metadata URL (`{API}/.well-known/oauth-protected-resource/mcp`).
- `405`: Authenticated GET with `Accept: text/event-stream`. Stateless serving has no session to attach a stream to, so the SDK answers 405. An unauthenticated stream probe is 401, not 405.

---

[API](https://skmtc.dev/apphandoff/apis/apphandoff-api.md) · [All operations](https://skmtc.dev/apphandoff/apis/apphandoff-api/llms.txt) · [OpenAPI document](https://skmtc.dev/apphandoff/apis/apphandoff-api/revisions/9f138fe46d56?raw)