# MCP server

Single endpoint, implemented in `api/mcp/index.mjs`:

```text
POST https://dishonkadoh.com/api/mcp
```

## Request handling

- **Method:** only `POST` is accepted — anything else gets `405
  method_not_allowed` with an `Allow: POST` header.
- **Origin check:** if an `Origin` header is present, it must be
  `https://dishonkadoh.com` or the request is rejected with `403
  invalid_origin`. Requests with no `Origin` header (e.g. most non-browser
  MCP clients) pass through.
- **Auth:** every request needs `Authorization: Bearer <token>` — see
  [Authentication](authentication.md). A missing/invalid/expired token
  returns `401 invalid_token` with a `WWW-Authenticate: Bearer
  realm="DK Business Solutions MCP", resource="..."` header, per the MCP
  auth spec.
- **Body:** must be a JSON-RPC 2.0 object (`{"jsonrpc": "2.0", "id", "method", "params"}`)
  — anything else gets a JSON-RPC `-32600 Invalid Request` error (still
  returned as HTTP `200`, per JSON-RPC convention).

## Supported methods

| Method | Behavior |
|---|---|
| `initialize` | Returns `protocolVersion: "2025-06-18"`, `capabilities: {tools: {}}`, and `serverInfo: {name: "dk-business-solutions", version: "1.0.0"}` |
| `notifications/initialized` | Acknowledged with a bare `202`, no body |
| `tools/list` | Returns the real tool list (currently just `company_information` — see [Tools](tools.md)) |
| `tools/call` | Dispatches to the named tool |
| anything else | JSON-RPC `-32601 Method not found` |

## Example: listing tools

```text
POST /api/mcp
Authorization: Bearer <access_token>
Content-Type: application/json

{"jsonrpc": "2.0", "id": 1, "method": "tools/list"}
```

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "result": {
    "tools": [
      {
        "name": "company_information",
        "description": "Returns information about DK Business Solutions.",
        "inputSchema": { "type": "object", "properties": {} }
      }
    ]
  }
}
```

For calling the tool itself, see [Tools](tools.md).