MCP JSON-RPC entry point
Single endpoint dispatching all MCP methods by method field:
initialize, ping, tools/list, tools/call, resources/list,
resources/read, prompts/list, prompts/get, completion/complete.
Two auth schemes accepted on Authorization: Bearer <token>:
the mck_ prefix routes to API-key path; everything else (HS256
JWT) routes to the OAuth client_credentials path. See
/.well-known/oauth-authorization-server for OAuth metadata.
Rate-limited per token: 60/min general, 10/hour for dangerous-op
tools. Audit row written on every tools/call to audit_log
with actor_kind='mcp'.
Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.