JSON-RPC 2.0 endpoint for the gateway's MCP server

JSON-RPC 2.0 endpoint exposing the gateway itself as an MCP server. It aggregates every server configured in MCP_SERVERS behind one URL, so MCP clients (opencode, infer, IDE assistants) configure a single entry and get the whole fleet, with the gateway's auth, metrics and guardrails applied to every tool call.

The endpoint lives at the root, not under /v1 - /v1/* is the OpenAI-compatible surface, MCP is its own protocol and clients expect a plain /mcp.

Gated by MCP_EXPOSE=true (and MCP_ENABLED=true); otherwise the gateway answers 403. Gateway auth is global, so when AUTH_ENABLE=true this endpoint requires a bearer token like every other route except /health.

The endpoint speaks MCP protocol version 2026-07-28 only, over the stateless Streamable HTTP transport with application/json responses. There is no initialize handshake and no session: every request carries its protocol version in params._meta["io.modelcontextprotocol/protocolVersion"] (alongside the required io.modelcontextprotocol/clientInfo and io.modelcontextprotocol/clientCapabilities), mirrored in the MCP-Protocol-Version, Mcp-Method and, for tools/call, Mcp-Name headers. Mcp-Name may use the =?base64?<value>?= encoding.

Supported methods:

Every result carries resultType: "complete" and identifies the gateway in _meta["io.modelcontextprotocol/serverInfo"].

Param and result shapes are the vendored MCP spec types in mcp/mcp-schema.yaml (RequestMetaObject, DiscoverResult, ServerCapabilities, ListToolsResult, CallToolRequestParams, CallToolResult); this spec only describes the JSON-RPC envelopes the gateway puts them in.

tools/list tolerates partial availability: when one of the configured MCP servers is unreachable its tools are omitted and the healthy servers' tools are still returned, rather than failing the whole call. A tools/call routed to an unavailable server fails with JSON-RPC error code -32603.

Errors use JSON-RPC error envelopes:

A request carrying an Origin header is rejected with 403: MCP clients are not browsers, and this blocks DNS-rebinding attacks. GET and DELETE answer 405 - there is no standalone stream and no session to terminate.

{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "name": "mcp_deepwiki_ask_question",
    "arguments": {
      "repoName": "inference-gateway/inference-gateway",
      "question": "How is MCP wired up?"
    },
    "_meta": {
      "io.modelcontextprotocol/protocolVersion": "2026-07-28",
      "io.modelcontextprotocol/clientInfo": {
        "name": "opencode",
        "version": "1.0.0"
      },
      "io.modelcontextprotocol/clientCapabilities": {}
    }
  }
}

{
  "jsonrpc": "2.0",
  "error": {
    "code": -32602,
    "message": "unknown tool: mcp_deepwiki_missing_tool"
  }
}