---
title: "The product MCP server, over one person's own CRM"
method: POST
path: "/mcp"
tags: ["MCP"]
---

# The product MCP server, over one person's own CRM

`POST /mcp`

## Request

- Base URL: `https://youspot.com`
- URL: `https://youspot.com/mcp`
- Auth: one of:
  - none
  - OAuth 2 (authorization code, authorization URL `https://youspot.com/oauth/authorize`, token URL `https://youspot.com/oauth/token`, scopes: `linkedin`)
  - HTTP bearer

Recommended endpoint, tracking the latest available implementation (currently v1). Use /mcp/v1 to pin v1.
`initialize`, `ping` and `tools/list` answer without a credential: nothing in them is one person's data, and a 401 on the handshake reads as a dead server.

`tools/call` needs a bearer token. Without one it answers 401 with `WWW-Authenticate: Bearer resource_metadata="..."` naming the RFC 9728 document.

JSON-RPC batching is refused, per MCP 2025-06-18. The tool schemas come from `tools/list`, not from this document.

## Headers

- `Idempotency-Key` string

## Request body

- JsonRpcRequest
  - `jsonrpc` '2.0'
  - `id` union: Omit it, with a `notifications/*` method, for a notification.
    - string
    - integer
  - `method` string, required
  - `params` object

## Response `200`

A JSON-RPC envelope.

- JsonRpcResponse
  - `jsonrpc` '2.0', required
  - `id` union
    - string
    - integer
  - `result` object
  - `error` object
    - `code` integer
    - `message` string

## Other responses

- `202`: A JSON-RPC notification was accepted. This is an acknowledgement, not a job: there is nothing to poll for. Long-running work is enqueued by a tool and reported at `/api/jobs/{job_id}`.
- `401`: A tool call with no usable credential.
- `422`: This `Idempotency-Key` was already used on this operation with a different request body.

---

[API](https://skmtc.dev/youspot/apis/youspot-http-api.md) · [All operations](https://skmtc.dev/youspot/apis/youspot-http-api/llms.txt) · [OpenAPI document](https://skmtc.dev/youspot/apis/youspot-http-api/revisions/6615ad5d017d?raw)