---
title: "Public MCP endpoint (JSON-RPC 2.0)"
method: POST
path: "/api/mcp/public"
tags: ["mcp", "catalog"]
---

# Public MCP endpoint (JSON-RPC 2.0)

`POST /api/mcp/public`

## Request

- Base URL: `https://www.supersetapp.com`
- URL: `https://www.supersetapp.com/api/mcp/public`
- Auth: one of:
  - none
  - HTTP bearer

Stateless Streamable HTTP MCP server over the public catalog. Protocol version 2025-06-18; supports `initialize`, `ping`, `tools/list`, and `tools/call`. Tools: `list_program_templates`, `get_page`, and — for a credential a person has claimed — `get_my_profile`. No credential is needed for the catalog tools. Described by the server card at `/.well-known/mcp/server-card.json`.

## Request body

- JsonRpcRequest: A JSON-RPC 2.0 request envelope.
  - `jsonrpc` '2.0', required
  - `id` union: Omit for a notification.
    - string
    - integer
  - `method` string, required: `initialize`, `ping`, `tools/list`, or `tools/call`.
  - `params` object

## Response `200`

A JSON-RPC 2.0 response.

- JsonRpcResponse: A JSON-RPC 2.0 response envelope.
  - `jsonrpc` '2.0', required
  - `id` union
    - string
    - integer
  - `result` object
  - `error` object
    - `code` integer
    - `message` string

## Other responses

- `202`: A notification was accepted. No body — every MCP client sends `notifications/initialized` right after the handshake.
- `401`: The presented credential is invalid or revoked.
- `403`: The browser Origin is not one of ours.
- `429`: Rate limit exceeded (60 requests per minute per client IP, policy "public"). Wait `Retry-After` seconds.

---

[API](https://skmtc.dev/supersetapp/apis/superset-api.md) - [All operations](https://skmtc.dev/supersetapp/apis/superset-api/llms.txt) - [OpenAPI document](https://skmtc.dev/supersetapp/apis/superset-api/revisions/80be14a3d402?raw)