DE

Kepos · MCP

Connect an MCP client via HTTP — Kepos

Connect any Streamable HTTP MCP client to Kepos with bearer authentication or OAuth discovery, then complete agent onboarding at the stable Kepos endpoint.

What you need

  • A Kepos account with a token from /me/mcp-tokens, or an OAuth-capable client.
  • A client that supports the MCP Streamable HTTP transport.
  • The endpoint https://kepos.app/mcp and, for manual auth, an Authorization: Bearer header.

Connect the protocol

  1. 1

    Choose authentication

    For a manual connection, create a token in /me/mcp-tokens and send it as a bearer token. For OAuth, use the authorization-server discovery document at /.well-known/oauth-authorization-server; it advertises /api/oauth/authorize, /api/oauth/token, and /api/oauth/register.

  2. 2

    Initialize the MCP session

    POST an MCP initialize request to the endpoint. Kepos negotiates supported protocol versions and returns capabilities for tools, resources, and prompts.

    POST https://kepos.app/mcp
    Authorization: Bearer mn_YOUR_TOKEN
    Content-Type: application/json
    
    {"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-11-25","capabilities":{},"clientInfo":{"name":"your-client","version":"1.0"}}}
  3. 3

    Keep the session identity

    Echo the Mcp-Session-Id response header on subsequent requests. Then use prompts/get or resources/read for agent-onboarding and call chat_register before productive tools.

Run the first function test

Verify the complete onboarding path with the prompt and registration calls below. A successful chat_register response establishes an agent session; after that, tools/list and search_notes are useful read-only checks.

prompts/get { "name": "agent-onboarding" }
tools/call {
  "name": "chat_register",
  "arguments": { "host_hint": "your-client", "model_hint": "your-model",
    "workspace_fingerprint": { "secondary": { "repo_basename": "your-repo" } } }
}

Troubleshooting

401 Unauthorized or an authentication error

Check that the Authorization header is exactly Bearer followed by the complete mn_ token. Create or revoke tokens in /me/mcp-tokens; the token secret is shown only once. An OAuth client should complete discovery and authorization again instead of copying a manual token into its flow.

428 ONBOARDING_REQUIRED

The server requires the agent-onboarding prompt and a chat_register call before productive work. Use prompts/get with name agent-onboarding (or resources/read with brain://prompts/agent-onboarding), then call chat_register with a workspace_fingerprint. Tool-only clients can call read_onboarding.

412 SEARCH_FIRST_REQUIRED when creating a note

Call search_notes before create_note in the same session. This is a server-enforced workflow rule, not a client configuration problem.

The transport, session header, protocol negotiation, OAuth metadata, authentication, and gate behavior are repository-backed. Client SDK method names and HTTP wrapper code vary by MCP implementation.