---
title: "MCP JSON-RPC endpoint"
method: POST
path: "/mcp"
tags: ["Kairos passthrough"]
---

# MCP JSON-RPC endpoint

`POST /mcp`

## Request

- Base URL: `https://api.infolang.ai`
- URL: `https://api.infolang.ai/mcp`
- Auth: one of:
  - HTTP bearer
  - HTTP bearer

HTTP-fronted Model Context Protocol endpoint (JSON-RPC 2.0).

**An unauthenticated request answers `401` with `WWW-Authenticate: Bearer resource_metadata="…/.well-known/oauth-protected-resource"`** — the OAuth discovery entry point (RFC 9728 §5.1). A client with no credential follows that header to the protected-resource document, then to the authorization server metadata, and runs the flow. The decision is made from the `Authorization` header alone; requests that DO carry a credential are forwarded unchanged.

Proxied verbatim to Kairos. The gateway applies NO authentication of its own here — /v1 and /mcp sit outside the /v2 middleware, so the Authorization header is forwarded untouched and Kairos is the sole authority. In practice that means either `il_*` credential is accepted (an API key, or an `il_oauth_` token — the latter is how an MCP client reaches /mcp); a Supabase session JWT is NOT, since Kairos cannot verify one. Response shapes are owned by Kairos. The gateway forwards ALL methods under /v1/* and /mcp — the operations listed here are the primary surface, not an exhaustive proxy inventory.

## Request body

- object

## Response `200`

JSON-RPC 2.0 response

## Other responses

- `401`: No credential presented — carries the WWW-Authenticate discovery challenge

---

[API](https://skmtc.dev/infolang/apis/infolang-api.md) · [All operations](https://skmtc.dev/infolang/apis/infolang-api/llms.txt) · [OpenAPI document](https://skmtc.dev/infolang/apis/infolang-api/revisions/d04bf6de72c8?raw)