MCP server reference
Technical reference of the MCP server of each integration. Transport, authorization, the tool list, errors and limits.
On this page
You do not need this page to publish your API. It is for teams that want to know exactly what the MCP clients see, or connect a client of their own.
Endpoint
POST https://connect.grostify.com/t/{slug}/mcp| Property | Value |
|---|---|
| Transport | Streamable HTTP, stateless. One JSON-RPC 2.0 message per POST, answered as application/json. |
| Not supported | Server sent events, batches and Mcp-Session-Id. GET and DELETE answer 405. |
| Protocol versions | 2025-11-25, 2025-06-18 and 2025-03-26 |
| Body | Up to 1 MB |
| Availability | Only integrations that are live with a verified domain. The rest answer 404. |
Notifications answer 202 without a body.
Authorization
The server follows the MCP authorization spec with OAuth 2.1. A request without a token answers 401 with:
WWW-Authenticate: Bearer resource_metadata="https://connect.grostify.com/.well-known/oauth-protected-resource/t/acme/mcp", scope="mcp:tools"Metadata
| Document | URL |
|---|---|
| Protected resource (RFC 9728) | /.well-known/oauth-protected-resource/t/{slug}/mcp |
| Authorization server (RFC 8414) | /.well-known/oauth-authorization-server/t/{slug} |
The issuer is https://connect.grostify.com/t/{slug}, with these endpoints under it: /oauth/authorize, /oauth/token, /oauth/revoke and /oauth/register.
Clients
- Client ID metadata documents of Claude, Claude Code and ChatGPT.
- Dynamic client registration (RFC 7591) for public clients whose redirect is Claude's or ChatGPT's callback, or a loopback address (
localhostor127.0.0.1).
Flow
| Parameter | Value |
|---|---|
| Grant | Authorization code with PKCE S256 |
resource | The MCP address, exactly |
| Scopes | mcp:tools (always) and offline_access |
| Client authentication | none or private_key_jwt |
Tokens
| Token | Lifetime |
|---|---|
| Authorization code | 60 seconds, single use |
Access token (JWT ES256) | 15 minutes |
| Refresh token | 30 days, renewed on each use |
Revoking a token at /oauth/revoke closes the whole connection.
Tools
tools/list returns, in a single page and sorted by name, the tools enabled in the channel of the connection.
{ "name": "acme_track_shipment", "title": "Track a shipment", "description": "Returns the status of a shipment by its tracking number...", "inputSchema": { "type": "object", "properties": { "tracking_number": { "type": "string", "description": "Tracking number, for example ACM4820193746." } }, "required": ["tracking_number"], "additionalProperties": false }, "annotations": { "readOnlyHint": true, "destructiveHint": false, "idempotentHint": true, "openWorldHint": true }}listChanged is false. A client sees changes in the next conversation.
Errors
Errors in the tool itself come back as a result with isError: true and a message for the model:
| Situation | Message |
|---|---|
| Missing argument | Missing required argument "x". |
| Unknown argument | Unknown argument "x". |
| Your API took too long | The API did not answer in time. |
| Your API answered 401 | The API rejected the credential. The user must reconnect the account. |
| Your API answered 403 | The user has no permission for this in the company's system. |
| Your API answered 404 | Not found. API said: ... |
| Your API answered 429 | The API is rate limiting. Try again later. |
| Your API answered 5xx | The API failed. Try again later. |
| Rate limit of the connection | Too many requests for this connection. Wait a minute and try again. |
| Session in your system expired | The connection to Acme expired. Reconnect the connector. |
A tool that does not exist or is not enabled answers the JSON-RPC error -32602 Unknown tool.
Rate limits
| Scope | Limit |
|---|---|
| Requests per connection | 300 per minute and 10,000 per day |
| Requests per integration | 3,000 per minute |
| Requests without a valid token, per IP | 60 per minute |
Every authenticated MCP request counts toward these limits, not only tool calls: initialize, tools/list and notifications too.