MCP transport (no event stream)
The transport is stateless — every request gets its own server — so nothing is ever pushed to a client. A request for the server-to-client event stream is declined with 405 and an Allow: POST, DELETE header, which MCP clients read as “no stream offered”.
GET
/mcpResponses
400The body is not a valid JSON-RPC message, or names an unsupported MCP protocol version.
jsonrpcstringrequirederrorobjectrequiredShow propertiesHide properties
codeintegerrequiredmin -9007199254740991 · max 9007199254740991
messagestringrequireddataanyidstring | nullrequired401No bearer token, or it is invalid, expired or revoked. The `WWW-Authenticate` header names the protected-resource metadata.
statusCodeintegerrequiredHTTP status code, repeated in the body.
min -9007199254740991 · max 9007199254740991
errorstringrequiredRFC 6750 error code, e.g. `invalid_token` or `insufficient_scope`.
error_descriptionstringHuman-readable explanation.
403The token lacks the grant the transport requires.
statusCodeintegerrequiredHTTP status code, repeated in the body.
min -9007199254740991 · max 9007199254740991
errorstringrequiredRFC 6750 error code, e.g. `invalid_token` or `insufficient_scope`.
error_descriptionstringHuman-readable explanation.
405No event stream is offered; the `Allow` header lists POST and DELETE.
406The `Accept` header must allow both `application/json` and `text/event-stream` (`GET` needs `text/event-stream`).
jsonrpcstringrequirederrorobjectrequiredShow propertiesHide properties
codeintegerrequiredmin -9007199254740991 · max 9007199254740991
messagestringrequireddataanyidstring | nullrequired429Too many rejected authentication attempts.
statusCodeintegerrequiredHTTP status code, repeated in the body.
min -9007199254740991 · max 9007199254740991
errorstringrequiredRFC 6750 error code, e.g. `invalid_token` or `insufficient_scope`.
error_descriptionstringHuman-readable explanation.
500Unexpected server error. The body never carries internal detail.
statusCodeintegerrequiredHTTP status code, repeated in the body.
min -9007199254740991 · max 9007199254740991
codestringrequiredStable machine-readable error code, e.g. `SECRET_NOT_FOUND` or `FORBIDDEN`. Branch on this, never on the message.
messagestringrequiredHuman-readable explanation. Wording may change.
fieldstringThe offending request field, present on validation failures.
503Token verification is temporarily unavailable. Retry later.
statusCodeintegerrequiredHTTP status code, repeated in the body.
min -9007199254740991 · max 9007199254740991
errorstringrequiredRFC 6750 error code, e.g. `invalid_token` or `insufficient_scope`.
error_descriptionstringHuman-readable explanation.
Request
curl -X GET "https://api.varsafe.dev/mcp"const response = await fetch("https://api.varsafe.dev/mcp", {
method: "GET"
});import requests
response = requests.get(
"https://api.varsafe.dev/mcp",
)Response
{
"jsonrpc": "2.0",
"error": {
"code": 0,
"message": "string",
"data": "string"
},
"id": 0
}{
"statusCode": 0,
"error": "string",
"error_description": "string"
}{
"statusCode": 0,
"error": "string",
"error_description": "string"
}No event stream is offered; the `Allow` header lists POST and DELETE.
{
"jsonrpc": "2.0",
"error": {
"code": 0,
"message": "string",
"data": "string"
},
"id": 0
}{
"statusCode": 0,
"error": "string",
"error_description": "string"
}{
"statusCode": 0,
"code": "string",
"message": "string",
"field": "string"
}{
"statusCode": 0,
"error": "string",
"error_description": "string"
}