Streamable HTTP MCP using signed-in, workspace-bound OAuth authority

POST 
/api/v1/operator/mcp

JSON-RPC initialization, tool listing and calls. Stateless requests accept only Bearer OAuth access tokens, never browser sessions or local-adapter credentials. Tool reads and renewals keep the operator REST role, Cloud plan/freeze/quota, workspace and Job approval gates. The optional stdio adapter remains independent.

Request

Responses

200

MCP JSON-RPC response

202

Notification accepted

400

OAuth refusal; fixed error code without upstream details

401

OAuth sign-in required

Response Headers

WWW-Authenticate

403

OAuth refusal; fixed error code without upstream details

404

OAuth refusal; fixed error code without upstream details

429

OAuth refusal; fixed error code without upstream details