curl --request POST \
  --url https://api.erstan.com/v1/mcp \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/list"
}
'

{
  "jsonrpc": "2.0",
  "id": "<string>",
  "result": {},
  "error": {}
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "details": [
      {
        "code": "<string>",
        "message": "<string>",
        "field": "<string>"
      }
    ],
    "requestId": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "details": [
      {
        "code": "<string>",
        "message": "<string>",
        "field": "<string>"
      }
    ],
    "requestId": "<string>"
  }
}

MCP

MCP endpoint

Stateless streamable-HTTP MCP endpoint (JSON-RPC 2.0). Supports initialize, tools/list, and tools/call. tools/list returns only the tools allowed by the connected-app OAuth grant or API-key scopes; tools/call re-checks that authorization, the connection owner’s current permissions, and applicable resource boundaries on every call. publish_agent validates and publishes only the exact current manageable revision; authoring never archives or deletes an agent. test_agent can run the guarded current draft in Builder Preview. update_agent, validate_agent, and publish_agent require both agents:read and agents:write; create_agent requires agents:write. run_agent accepts optional top-level attachments with name, type, and either base64 content or an existing storageKey. comment_on_task accepts optional inline base64 attachments under the Manage work permission; read_task returns their teamFileId and comment activityId for later retrieval when View files is also granted. The Task surface also supports complete property/hierarchy updates, structured upload/Team-file/document/URL attachments (Inbox excluded), comment edit/delete, participants, reactions, and lifecycle operations. list_task_options returns scoped selectable teams, projects, eligible Agents, members, labels, and non-cyclic parent Tasks under View work. read_task returns parent/subtask, participant, attachment, thread, execution, and approval references. Task-linked run tools authorize the visible Task and exact Task-to-execution-to-thread relationship, so they use View work/Manage work rather than requiring an additional View runs or Run agents grant. General run tools remain same-credential scoped. GET and DELETE return 405 — there are no SSE sessions in v1. See the Connect a Coding Agent guide for the tool table and client configuration.

POST

mcp

curl --request POST \
  --url https://api.erstan.com/v1/mcp \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/list"
}
'

{
  "jsonrpc": "2.0",
  "id": "<string>",
  "result": {},
  "error": {}
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "details": [
      {
        "code": "<string>",
        "message": "<string>",
        "field": "<string>"
      }
    ],
    "requestId": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "details": [
      {
        "code": "<string>",
        "message": "<string>",
        "field": "<string>"
      }
    ],
    "requestId": "<string>"
  }
}

Authorizations

Authorization

string

header

required

Recommended authorization for Claude, Codex, and other interactive MCP hosts. Install the official Erstan plugin, complete browser consent, and manage the resulting grant in Settings > Connected apps.

Body

application/json

JSON-RPC 2.0 request accepted by the MCP endpoint.

jsonrpc

string

required

Allowed value: "2.0"

method

string

required

MCP method, such as initialize, tools/list, or tools/call.

Omitted for notifications.

params

object

For tools/call, includes name (tool name) and arguments.

Response

JSON-RPC response. Tool errors are returned inside the JSON-RPC envelope, not as HTTP errors.

JSON-RPC 2.0 response envelope returned by the MCP endpoint.

jsonrpc

string

required

Allowed value: "2.0"

result

object

Present on success. Tool results are content arrays of {type:'text', text} items containing stable JSON payloads.

error

object

Present on failure, including scope, permission, allowlist (access_not_configured), validation, and rate-limit errors.

Developer API

Partners

API Reference

MCP endpoint

Authorizations

Body

Response