---
title: "MCP JSON-RPC endpoint (both protocol revisions)"
method: POST
path: "/mcp-bot"
tags: ["MCP"]
---

# MCP JSON-RPC endpoint (both protocol revisions)

`POST /mcp-bot`

## Request

- Base URL: `https://api.apphandoff.com/api`
- URL: `https://api.apphandoff.com/api/mcp-bot`
- Auth: API key in cookie `sb-access-token`

The single MCP exchange endpoint. Serves protocol revision 2026-07-28 natively and answers 2025-era clients from the same tool surface via the SDK's stateless legacy leg. Every exchange is self-contained: no session is established, and no `Mcp-Session-Id` is issued (one sent by a legacy client is accepted and ignored). Responses are `application/json` or, on the legacy leg, a `text/event-stream` frame carrying the same JSON-RPC message.

## Request body

- object

## Response `200`

JSON-RPC response. A `tools/call` the bearer's scopes cannot reach is ALSO answered here (HO-6814), as a typed tool result with `isError: true` and `structuredContent.code: "INSUFFICIENT_SCOPE"` — never an RFC 6750 403 step-up, which made one connector loop refresh-then-retry until its own 1800s timeout.

- object

## Other responses

- `400`: Malformed request body (JSON-RPC parse error, code -32700).
- `401`: Not authenticated
- `429`: Rate limited (domain_code RATE_LIMITED).

---

[API](https://skmtc.dev/apphandoff/apis/apphandoff-api.md) · [All operations](https://skmtc.dev/apphandoff/apis/apphandoff-api/llms.txt) · [OpenAPI document](https://skmtc.dev/apphandoff/apis/apphandoff-api/revisions/9f138fe46d56?raw)