curl --request POST \
--url https://api.erstan.com/v1/mcp \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"jsonrpc": "2.0",
"id": 1,
"method": "tools/list"
}
'{
"jsonrpc": "2.0",
"id": "<string>",
"result": {},
"error": {}
}{
"error": {
"code": "<string>",
"message": "<string>",
"details": [
{
"code": "<string>",
"message": "<string>",
"field": "<string>"
}
],
"requestId": "<string>"
}
}{
"error": {
"code": "<string>",
"message": "<string>",
"details": [
{
"code": "<string>",
"message": "<string>",
"field": "<string>"
}
],
"requestId": "<string>"
}
}MCP endpoint
Stateless streamable-HTTP MCP endpoint (JSON-RPC 2.0). Supports initialize, tools/list, and tools/call. tools/list returns only the tools allowed by the connected-app OAuth grant or API-key scopes; tools/call re-checks that authorization, the connection owner’s current permissions, and applicable resource boundaries on every call. publish_agent validates and publishes only the exact current manageable revision; authoring never archives or deletes an agent. test_agent can run the guarded current draft in Builder Preview. update_agent, validate_agent, and publish_agent require both agents:read and agents:write; create_agent requires agents:write. run_agent accepts optional top-level attachments with name, type, and either base64 content or an existing storageKey. comment_on_task accepts optional inline base64 attachments under the Manage work permission; read_task returns their teamFileId and comment activityId for later retrieval when View files is also granted. The Task surface also supports complete property/hierarchy updates, structured upload/Team-file/document/URL attachments (Inbox excluded), comment edit/delete, participants, reactions, and lifecycle operations. list_task_options returns scoped selectable teams, projects, eligible Agents, members, labels, and non-cyclic parent Tasks under View work. read_task returns parent/subtask, participant, attachment, thread, execution, and approval references. Task-linked run tools authorize the visible Task and exact Task-to-execution-to-thread relationship, so they use View work/Manage work rather than requiring an additional View runs or Run agents grant. General run tools remain same-credential scoped. GET and DELETE return 405 — there are no SSE sessions in v1. See the Connect a Coding Agent guide for the tool table and client configuration.
curl --request POST \
--url https://api.erstan.com/v1/mcp \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"jsonrpc": "2.0",
"id": 1,
"method": "tools/list"
}
'{
"jsonrpc": "2.0",
"id": "<string>",
"result": {},
"error": {}
}{
"error": {
"code": "<string>",
"message": "<string>",
"details": [
{
"code": "<string>",
"message": "<string>",
"field": "<string>"
}
],
"requestId": "<string>"
}
}{
"error": {
"code": "<string>",
"message": "<string>",
"details": [
{
"code": "<string>",
"message": "<string>",
"field": "<string>"
}
],
"requestId": "<string>"
}
}Authorizations
Recommended authorization for Claude, Codex, and other interactive MCP hosts. Install the official Erstan plugin, complete browser consent, and manage the resulting grant in Settings > Connected apps.
Body
Response
JSON-RPC response. Tool errors are returned inside the JSON-RPC envelope, not as HTTP errors.
JSON-RPC 2.0 response envelope returned by the MCP endpoint.
"2.0"Present on success. Tool results are content arrays of {type:'text', text} items containing stable JSON payloads.
Present on failure, including scope, permission, allowlist (access_not_configured), validation, and rate-limit errors.