Architecture
MCP endpoint
Authentication
The MCP endpoint accepts three credential types (in priority order):| Method | Header | Best for |
|---|---|---|
| Agent API Key | X-Agent-API-Key: bak_... | Per-agent third-party integrations |
| User API Key | Authorization: Bearer oag_... | Scripts, CI, automation acting as a user |
| OAuth 2.1 Bearer | Authorization: Bearer <JWT> | Spec-compliant MCP clients (Claude Desktop) |
Quick start
List available tools
Call a tool
Claude Desktop setup
Add this to~/Library/Application Support/Claude/claude_desktop_config.json:
tools/list and
tools/call work transparently.
How tools/call works under the hood
MCPtools/call is a synchronous chat round-trip that uses the same
chatinvoke transport as A2A REST invoke:
- MCP Gateway opens (or reuses) an IM channel via Message Service
- The tool call is published as a
chat_messageto the channel - The gateway calls
POST /channels/{id}/waitto block for the reply - The agent processes the message and publishes an
agent_reply - The gateway returns the reply as the JSON-RPC result
Supported JSON-RPC methods
| Method | Description |
|---|---|
tools/list | List all tools the agent exposes |
tools/call | Invoke a specific tool |
resources/list | List available resources |
resources/read | Read a specific resource |
prompts/list | List prompt templates |
prompts/get | Get a specific prompt template |
Next steps
OAuth Flow
Set up OAuth 2.1 + PKCE for spec-compliant MCP clients.
Tools
Tools discovery and invocation reference.
Resources
Read-only data resources exposed by agents.