Protocol and errors

For people implementing an MCP client. You do not need this to connect an AI app.

Transport

Streamable HTTP. POST JSON-RPC 2.0 to /mcp and the response comes back on the same connection.

SSE (Server-Sent Events) is not supported. Clients that assume streaming should be configured to use plain POST.

Server info

initialize returns:

{
  "protocolVersion": "2025-06-18",
  "capabilities": {
    "tools": {
      "listChanged": false
    }
  },
  "serverInfo": {
    "name": "clone-plus-mcp",
    "version": "1.0.0",
    "title": "Clone+ Knowledge Base"
  }
}

There is no session. You may skip initialize and go straight to tools/list or tools/call. No session ID to track.

Implemented methods

Method	Description
`initialize`	Returns server info and capabilities (optional)
`notifications/initialized`	Accepted, returns nothing
`ping`	Returns `{}`
`tools/list`	Lists the available tools
`tools/call`	Runs a tool

tools/list is filtered by the token's scope. With a read-only token the write tools do not appear at all.

JSON-RPC error codes

Standard codes plus the conventional MCP extensions.

Code	Meaning
`-32700`	Parse error
`-32600`	Invalid request
`-32601`	Method not found
`-32602`	Invalid params
`-32603`	Internal error
`-32001`	Unauthorized
`-32002`	Forbidden
`-32003`	Not found
`-32004`	Rate limit exceeded

HTTP status codes

Status	When
200	Success — and also permission denied (see below)
204	A notification (a request with no id) was accepted
401	Authentication failed; sent with a `WWW-Authenticate` header
405	Method other than GET or POST
415	`Content-Type` was not `application/json`
429	Per-minute request limit exceeded

Permission denied returns 200

Calling a write tool with a read-only token returns HTTP 200 with -32002 in the JSON-RPC error. Looking only at the HTTP status will read as success. Note also that 403 and 404 are never returned (outside /docs/).