MCP JSON-RPC endpoint (both protocol revisions)
const url = 'https://example.com/api/mcp-bot';const options = { method: 'POST', headers: { cookie: 'sb-access-token=<sb-access-token>', 'Content-Type': 'application/json' }, body: '{}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://example.com/api/mcp-bot \ --header 'Content-Type: application/json' \ --cookie sb-access-token=<sb-access-token> \ --data '{}'The single MCP exchange endpoint. Serves protocol revision 2026-07-28 natively and answers 2025-era clients from the same tool surface via the SDK’s stateless legacy leg. Every exchange is self-contained: no session is established, and no Mcp-Session-Id is issued (one sent by a legacy client is accepted and ignored). Responses are application/json or, on the legacy leg, a text/event-stream frame carrying the same JSON-RPC message.
Authorizations
Section titled “Authorizations ”Request Body required
Section titled “Request Body required ”object
Responses
Section titled “ Responses ”JSON-RPC response. A tools/call the bearer’s scopes cannot reach is ALSO answered here (HO-6814), as a typed tool result with isError: true and structuredContent.code: "INSUFFICIENT_SCOPE" — never an RFC 6750 403 step-up, which made one connector loop refresh-then-retry until its own 1800s timeout.
object
Malformed request body (JSON-RPC parse error, code -32700).
object
Not authenticated
object
Human-readable error message
Stable machine-readable error code for client branching
First validation message per field path
object
Structured validation issues (Zod)
object
Seconds until rate limit resets (429 responses)
True if re-linking GitHub may fix the issue
Rate limited (domain_code RATE_LIMITED).