Call the MCP server
The Model Context Protocol server (Streamable HTTP, stateless; the 2026-07-28 protocol revision only, every other revision is refused): one JSON-RPC request per POST, one JSON answer. Its tools read the same reports as the REST API, with the caller's permissions. The credential is an organization API key, or, when the instance's PUBLIC_URL is https (or http on a loopback host), an OAuth access token issued to the MCP client for one organization; a session cookie never counts. An Origin header, when sent, must be the instance's own (PUBLIC_URL or a DASHBOARD_ORIGINS entry; else 403). 120 requests a minute per API key, or per user and MCP client for an OAuth token (429). Every refusal is a JSON-RPC error that keeps its HTTP status; a 401 carries the OAuth challenge (WWW-Authenticate) while OAuth is on.
x-api-key<token>An organization API key (ak_…), with the permissions and the sites it was created with. For servers and scripts: no cookie and no Origin check. Also accepted as Authorization: Bearer ak_… (apiKeyBearer). A request carries one credential: a key sent with a share token or a live session cookie is 400 (details.reason: ambiguous_credentials).
application/json- body
jsonrpc*"2.0""2.0"[key: string]?unknownThe JSON-RPC answer
application/json- response
The JSON-RPC answer
jsonrpc*"2.0""2.0"[key: string]?unknowncurl -X POST 'https://pilotfox.app/api/mcp' \ -H 'Content-Type: application/json' \ -d '{ "jsonrpc": "2.0", "property1": null, "property2": null}'{ "jsonrpc": "2.0", "property1": null, "property2": null}