---
title: "Workout MCP endpoint (JSON-RPC 2.0)"
method: POST
path: "/api/mcp"
tags: ["mcp", "workouts"]
---

# Workout MCP endpoint (JSON-RPC 2.0)

`POST /api/mcp`

## Request

- Base URL: `https://www.supersetapp.com`
- URL: `https://www.supersetapp.com/api/mcp`
- Auth: HTTP bearer

The MCP URL to paste into a connector. Serves the claiming person's own training tools. `initialize` and `ping` need no scope; `tools/list` needs a read scope — `workouts.read`, `health.read`, or `coaching.read` — and the write scopes alone cannot list, only call their own tools. The plain REST equivalent is `listWorkoutTools` / `callWorkoutTool`.

## Request body

- JsonRpcRequest: A JSON-RPC 2.0 request envelope.
  - `jsonrpc` '2.0', required
  - `id` union: Omit for a notification.
    - string
    - integer
  - `method` string, required: `initialize`, `ping`, `tools/list`, or `tools/call`.
  - `params` object

## Response `200`

A JSON-RPC 2.0 response.

- JsonRpcResponse: A JSON-RPC 2.0 response envelope.
  - `jsonrpc` '2.0', required
  - `id` union
    - string
    - integer
  - `result` object
  - `error` object
    - `code` integer
    - `message` string

## Other responses

- `202`: A notification was accepted. No body — every MCP client sends `notifications/initialized` right after the handshake.
- `401`: Missing, invalid, or revoked credential.
- `403`: The credential lacks a scope this needs. A missing scope carries a challenge naming it; the app-variant guard denies without one.
- `429`: Throttled at 210 requests per min. Honour `Retry-After`.

---

[API](https://skmtc.dev/supersetapp/apis/superset-api.md) - [All operations](https://skmtc.dev/supersetapp/apis/superset-api/llms.txt) - [OpenAPI document](https://skmtc.dev/supersetapp/apis/superset-api/revisions/80be14a3d402?raw)