---
title: "App MCP endpoint"
method: POST
path: "/_run402/mcp"
tags: ["Stable Hosts"]
---

# App MCP endpoint

`POST /_run402/mcp`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/_run402/mcp`
- Auth: none required

Every tenant host is an MCP server (streamable HTTP, single JSON-RPC responses): `initialize`, `ping`, `tools/list`, `tools/call`. Tools are the live release's routed functions that export a static `tool` declaration; a call is a POST to the tool's route. Ungated tools need no token; a gated call without a valid `Authorization: Bearer` access token answers 401 with `WWW-Authenticate: Bearer resource_metadata=…, scope="tools"`. Cookies never authenticate; a cross-origin request is refused. A body of only notifications is accepted with 202 and no body.

## Request body

- object

## Response `200`

JSON-RPC response.

- object

## Other responses

- `401`: Sign-in required or the token is invalid/expired/revoked (`WWW-Authenticate`).
- `403`: Cross-origin request refused.

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/893607557f50?raw)