The hosted endpoint takes its whole configuration from the request. There are no sessions: every POST /mcp carries the credential, and every tool call is re-authorized by the API's normal access evaluation. (This page is the project endpoint https://core.inmake.dev/mcp; the console's endpoint inmake.dev/mcp takes a personal access token, no store header, and keeps an mcp-session-id — see Personal access tokens.)
| Header | Required | Description |
|---|---|---|
access-token |
always | A store access token (a store-scoped service token preferred). Authorization: Bearer <token> is accepted as an alias. |
store |
always | The store id this session is pinned to — one store per conversation. To work on another store, start a new session with its id. |
Accept |
recommended | application/json, text/event-stream per the MCP spec. Plain-JSON clients without it are accepted too. |
content-type |
always | application/json. |
What is pinned#
The hosted server never offers useStore and ignores any per-call store / env arguments: the store header is the tenant, the environment is fixed by the host you call (https://core.inmake.dev or https://demo-core.inmake.dev). This is the one-store-per-conversation sandbox — a client that wants another store sends another header.
The envelope#
Standard JSON-RPC 2.0 over Streamable HTTP, JSON responses only (no SSE stream, no session ids):
{ "jsonrpc": "2.0", "id": 1, "method": "initialize",
"params": { "protocolVersion": "2025-03-26", "capabilities": {},
"clientInfo": { "name": "my-client", "version": "1.0" } } }tools/list, resources/list, tools/call ({name, arguments}) and resources/read ({uri}) follow. A GET /mcp answers 405 — the endpoint is POST-only.
Results#
Every tool result is one text content item whose text is JSON: {ok, …, env, store, tokenScope}. ok: false marks a refused or failed call (the envelope's isError is set too); env and store say which tenant the call actually touched; tokenScope is "master" or "store" — if you see master, swap the credential for a store token.