MCP

Hosted MCP endpoint (stateless Streamable HTTP)

One JSON-RPC 2.0 request per call — initialize, tools/list, tools/call, etc. — dispatched via the official MCP TypeScript SDK’s StreamableHTTPServerTransport with sessionIdGenerator: undefined (a fresh McpServer is built PER REQUEST; no server-held session, safe on a horizontally-scaled deployment). Auth + org scoping mirror POST /v1/run/:flow exactly (pre-auth IP limit → bearer key → org → per-org limit); the tool registry is one tool per the caller’s org’s automations that are simultaneously published, MCP-enabled (mcp_enabled !== false), and within the key’s scope — a key that fails any of those three never sees that tool in tools/list, rather than seeing it and getting a permission error on call. Secret-typed inputs are never part of a tool’s inputSchema; they resolve server-side exactly as /v1/run/:flow resolves them. A jbt_test_* key gets the same test-mode API keys cannot run automations that use secrets rejection as the REST gateway.

Response mode is negotiated on the Accept header (not its presence — both media types are required by the Streamable-HTTP spec — but their ORDER): text/event-stream listed before application/json opts into an SSE stream of the tool result (plus, if the call carried _meta.progressToken, notifications/progress events replayed from the run’s real journal — never invented progress); the default (no Accept, or application/json first) returns one buffered JSON-RPC response.

Dispatch mirrors the REST gateway: in the default sync mode a tools/call runs the automation in-request; in queue mode (JT_RUN_DISPATCH=queue) it enqueues and returns {run_id, status:"queued"} immediately, and an extra get-run-status tool (registered ONLY in queue mode, and only if no real automation is named that) lets the client poll it.

POST

mcp

curl --request POST \
  --url https://api.jinbatrail.indx.jp/mcp \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/list"
}
'

{
  "jsonrpc": "<string>",
  "id": "<string>",
  "result": {},
  "error": {
    "code": 123,
    "message": "<string>"
  }
}

{
  "jsonrpc": "<string>",
  "id": "<string>",
  "result": {},
  "error": {
    "code": 123,
    "message": "<string>"
  }
}

{
  "error": "<string>",
  "message": "<string>"
}

{
  "error": "<string>",
  "message": "<string>"
}

{
  "error": "<string>",
  "message": "<string>"
}

承認

Authorization

string

header

必須

An org-scoped API key, format jbt_live_<rand> or jbt_test_<rand> (packages/service/src/auth.ts's issueApiKey). Minted via POST /api/keys; the plaintext is shown exactly once. Two boundaries are enforced on every call: (1) test/live — a jbt_test_* key is rejected with 403 test_key_forbidden on any automation that declares a secret-typed input, even unsupplied; only a jbt_live_* key can exercise production credentials. (2) per-key scope — an optional automation-name allowlist set at mint time; an unscoped key (the default) reaches every published automation in its org. Used ONLY on POST /v1/run/:flow and POST /mcp — every other route uses cookieAuth.

ボディ

application/json

A standard JSON-RPC 2.0 request/notification, per the MCP spec (initialize, tools/list, tools/call, …). The MCP TypeScript SDK owns the exact per-method params shapes; not re-specified here.

jsonrpc

string

必須

Allowed value: "2.0"

method

string

必須

params

object

レスポンス

A JSON-RPC response (default) or a text/event-stream of one or more SSE events carrying the same JSON-RPC payload, depending on the negotiated Accept order.

A standard JSON-RPC 2.0 response — either result or error, never both.

jsonrpc

string

必須

Allowed value: "2.0"

必須

result

object

error

object

Show child attributes

Not supported (stateless transport)`DELETE` (session termination, in the stateful variant of the protocol) always answers `405` — there is no session to terminate under `sessionIdGenerator: undefined`.

curl --request POST \
  --url https://api.jinbatrail.indx.jp/mcp \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/list"
}
'

{
  "jsonrpc": "<string>",
  "id": "<string>",
  "result": {},
  "error": {
    "code": 123,
    "message": "<string>"
  }
}

{
  "jsonrpc": "<string>",
  "id": "<string>",
  "result": {},
  "error": {
    "code": 123,
    "message": "<string>"
  }
}

{
  "error": "<string>",
  "message": "<string>"
}

{
  "error": "<string>",
  "message": "<string>"
}

{
  "error": "<string>",
  "message": "<string>"
}