---
title: "Send MCP message"
method: POST
path: "/mcp"
tags: ["MCP"]
---

# Send MCP message

`POST /mcp`

Streamable HTTP endpoint for the Model Context Protocol. It serves the 2026-07-28 revision natively and falls back to stateless 2025-era Streamable HTTP for older clients.

Each POST carries one JSON-RPC message; batch arrays are not part of either served transport revision.

The bearer must be a user-delegated OAuth access token issued by the Inth authorization server; organization API keys are rejected. Clients discover the authorization server through `/.well-known/oauth-protected-resource/mcp`, advertised on the `WWW-Authenticate` challenge of a 401.

Serving is stateless, so there are no sessions: `GET` and `DELETE` answer `405`.

## Request body

- object

## Response `200`

JSON-RPC response. Tool failures are reported in the result body, not as an HTTP status.

- object

## Other responses

- `202` — JSON-RPC notification accepted.
- `400` — Malformed JSON-RPC request, invalid protocol envelope, or request/header mismatch.
- `401` — Missing or invalid OAuth access token. The `WWW-Authenticate` header points to protected-resource discovery.
- `403` — Valid OAuth access token without the required `mcp:tools` scope.
- `429` — MCP request limit exceeded for this user and OAuth client pair.
- `500` — Internal JSON-RPC server error.

---

[API](https://skmtc.dev/inth/apis/inth-api.md) · [All operations](https://skmtc.dev/inth/apis/inth-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/inth/inth-api/revisions/97262bd49ddd/schema)