Reference
Transport, sign-in, scopes, tokens and limits, for MCP client and tool builders.
| Topic | Details |
|---|---|
| Server URL | https://app.cueston.com/api/mcp |
| Transport | Streamable HTTP (POST, JSON responses). Protocol versions 2025-06-18, 2025-03-26 and 2024-11-05. |
| Capabilities | Tools (with read-only, destructive and idempotent hints), prompts and resources. |
| Sign-in | OAuth 2.1 with PKCE (S256). Apps register themselves with a Client ID Metadata Document or dynamic client registration. |
| Discovery | https://app.cueston.com/.well-known/oauth-protected-resource/api/mcp |
| Scopes | mcp:read, mcp:write, mcp:publish |
| Tokens | Access tokens last 1 hour. Refresh tokens last 30 days and rotate on every use. |
| API keys | Header Authorization: Bearer sk_… |
| Limits | 120 requests a minute per connection, 600 tool calls a minute per workspace, 20 messages per batch, 256 KB per request. |
Tokens are issued for the MCP server only: a token sent to any other API route is refused. Replaying a refresh token that was already used disconnects the app.
When a tool's arguments don't match its schema, the JSON-RPC error message lists each problem, one per line, so the model can fix its call.