The endpoint follows the Streamable HTTP standard with OAuth 2.1, including automatic discovery and dynamic client registration. Any compatible MCP client connects with the same URL.
Interoperability details
Discovery metadata is published at every path clients usually look for (the root and under /mcp, in the OAuth and OpenID Connect variants). Registration accepts both Dynamic Client Registration and Client ID Metadata Documents. The token endpoint accepts public clients, client_secret_post and client_secret_basic. There is a single, read-only scope, and clients asking for other scopes keep working. CORS exposes the authentication challenge, so connectors running in the browser can start the flow too.