Skip to Content
APIMCP

MCP

MCP is a first-class API surface in Onprest. It exposes agent-defined capabilities as tools, so AI agents call named business operations instead of receiving raw database access.

The MCP endpoint is JSON-RPC over HTTP.

Onprest’s gateway does not know SQL, DB credentials, or business meaning. It builds tools/list from agent-owned OpenAPI metadata and filters it by API key capability authorization. tools/call still runs through the on-prem agent, where params, policy, SQL execution, and result allow-lists are enforced.

Endpoint

POST /mcp
Authorization: Bearer {api_key}
Content-Type: application/json

POST is the only allowed HTTP method. Other methods return GATEWAY_METHOD_NOT_ALLOWED.

Methods

MethodPurpose
initializeMCP initialization response
pingLiveness check
tools/listReturn visible capabilities as MCP tools
tools/callExecute a capability

tools/list

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/list"
}

gateway builds the tool list from cached OpenAPI metadata and filters it by the caller’s API key capabilities.

tools/call

{
  "jsonrpc": "2.0",
  "id": 2,
  "method": "tools/call",
  "params": {
    "name": "get_customer",
    "arguments": {
      "customer_id": 1
    }
  }
}

The tool name maps to a capability name. arguments maps to capability params.

Errors

JSON parse and JSON-RPC structure errors are returned as MCP JSON-RPC errors with HTTP 200. Gateway auth, IP, rate limit, offline agent, and capability authorization failures use HTTP errors.

RESTOpenAPI