---
title: "Model Context Protocol (MCP) endpoint — token in URL path"
method: POST
path: "/mcp/{token}"
tags: ["mcp"]
---

# Model Context Protocol (MCP) endpoint — token in URL path

`POST /mcp/{token}`

Same JSON-RPC 2.0 endpoint as `POST /mcp`, but the Public API token is supplied **as a path parameter** instead of through the `Authorization` header or the `?token=` query string.

This variant exists because some MCP clients cannot set custom HTTP headers nor query strings. Behavior is otherwise **strictly identical** to `POST /mcp`:

- same JSON-RPC methods (`initialize`, `tools/list`, `tools/call`)
- same rate limiting (1 req/s per token, burst 10)
- same permission and Monitoring rules
- same stateless behavior (no `Mcp-Session-Id`)

> ⚠️ **Security note** — The token is part of the URL and will likely be logged by proxies, browsers and access logs. Use this variant only when neither the `Authorization` header nor the `?token=` query string is available, and rotate any token that may have leaked.

OpenAPI 3.0 cannot declare an `apiKey` security scheme located in `path`, so this operation is documented with the `AuthorizationPath` scheme (declared as `query` for tooling compatibility — the actual transport is the URL path shown by the `token` path parameter below).

## Path parameters

- `token` string, required

## Request body

- JsonRpcRequest
  - `jsonrpc` '2.0', required — JSON-RPC protocol version. Must be "2.0".
  - `id` union — Request identifier. The server echoes it back in the response.
    - string
    - integer
  - `method` 'initialize' | 'tools/list' | 'tools/call', required — The JSON-RPC method to call: `initialize`, `tools/list`, or `tools/call`.
  - `params` object — Method-specific parameters. Required for `initialize` and `tools/call`, optional for `tools/list`.

## Response `200`

JSON-RPC response. See `POST /mcp` for the response shape and examples.

- JsonRpcResponse
  - `jsonrpc` '2.0', required
  - `id` union — Echoed request identifier, or null for notifications.
    - string
    - integer
  - `result` object — Present on success. Content depends on the method called.
  - `error` JsonRpcError
    - `code` integer, required — JSON-RPC error code. Standard codes: -32700 (parse error), -32600 (invalid request), -32601 (method not found), -32602 (invalid params), -32603 (internal error).
    - `message` string, required — Human-readable error message.
    - `data` unknown

## Other responses

- `401` — Missing or invalid API key.
- `429` — HTTP rate limit exceeded (1 req/s per API key, burst 10).

---

[API](https://skmtc.net/ringover/apis/ringover-public-api.md) · [All operations](https://skmtc.net/ringover/apis/ringover-public-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/ringover/ringover-public-api/revisions/9da73dd2f99e/schema)