Endpoints & auth

Everything a client needs, without the surrounding explanation. For the reasoning behind any of it, see the MCP gateway.

MCP endpoint

Server URLhttps://mcp.msharti.dev/mcp

ProtocolModel Context Protocol, revision 2025-03-26

TransportStreamable HTTP

Session headerMcp-Session-Id

Consolehttps://apps.msharti.dev

OAuth 2.1

Discovery document/.well-known/oauth-authorization-server

Authorization endpointhttps://mcp.msharti.dev/oauth/authorize

Token endpointhttps://mcp.msharti.dev/oauth/token

Registration endpointhttps://mcp.msharti.dev/oauth/register

PKCE methodS256 · required

Dynamic registrationSupported. No application to create by hand.

API key format

Patternmsh_<assistant>_<random>

Claudemsh_cla_…

Copilotmsh_cop_…

Custom clientmsh_cus_…

TransmissionAuthorization: Bearer <key>

VisibilityShown once at creation. Only the prefix is stored.

Generated atConsole → Settings → API Keys

Client configuration

static bearer token

{
  "mcpServers": {
    "msharti": {
      "transport": "http",
      "url": "https://mcp.msharti.dev/mcp",
      "headers": {
        "Authorization": "Bearer msh_cus_xxxxxxxxxxxxxxxx"
      }
    }
  }
}

Clients capable of interactive OAuth need only the URL: the discovery document tells them the rest.

Gateway enforcement

SQL statementsSELECT only · INSERT, UPDATE and DELETE rejected at the gateway

SQL row limit500 per query

SQL timeout30 seconds

Tool authorisationDeny by default. Allowlist evaluated on the tool name.

Tool discoveryFiltered by role before the client sees it.

Rate limitingPer tenant, per day. See limits and plans.

Response handlingSecrets stripped, call written to the audit log.

Credential storage

EncryptionAES-256-GCM

Key storageHeld separately from the ciphertext

OAuth tokensAuto-refreshed before expiry

IsolationPer-connector container, plus database row-level security

Support

Email[email protected]

Custom connectorsTwo to five business days, scoped as an engagement