Model Context Protocol (MCP) endpoint — token in URL path

Same JSON-RPC 2.0 endpoint as POST /mcp, but the Public API token is supplied as a path parameter instead of through the Authorization header or the ?token= query string.

This variant exists because some MCP clients cannot set custom HTTP headers nor query strings. Behavior is otherwise strictly identical to POST /mcp:

• same JSON-RPC methods (initialize, tools/list, tools/call)
• same rate limiting (1 req/s per token, burst 10)
• same permission and Monitoring rules
• same stateless behavior (no Mcp-Session-Id)

⚠️ Security note — The token is part of the URL and will likely be logged by proxies, browsers and access logs. Use this variant only when neither the Authorization header nor the ?token= query string is available, and rotate any token that may have leaked.

OpenAPI 3.0 cannot declare an apiKey security scheme located in path, so this operation is documented with the AuthorizationPath scheme (declared as query for tooling compatibility — the actual transport is the URL path shown by the token path parameter below).