POST
/
curl -X POST https://mcp.costmcp.com \
  -H "Authorization: Bearer $COSTMCP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "tools/list",
    "params": {}
  }'
Canonical agent URL: https://mcp.costmcp.com Stateless Streamable HTTP MCP. Auth: Bearer cmcp_at_... (OAuth) or Bearer cmcp_live_... (API key). The legacy path https://api.costmcp.com/api/mcp still works; prefer the dedicated MCP host. Unauthenticated requests return 401 with: 
WWW-Authenticate: Bearer resource_metadata="https://mcp.costmcp.com/.well-known/oauth-protected-resource", ...

​
Client config

Paste the URL into ChatGPT, Claude, Cursor, or any remote MCP client: 
{
  "mcpServers": {
    "costmcp": {
      "url": "https://mcp.costmcp.com"
    }
  }
}
OAuth clients discover the authorization server from protected resource metadata. For API-key clients (e.g. mcp-remote): 
{
  "mcpServers": {
    "costmcp": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://mcp.costmcp.com",
        "--header",
        "Authorization: Bearer cmcp_live_..."
      ]
    }
  }
}

​
JSON-RPC methods

MethodResult
initializeProtocol + serverInfo: { name: "costmcp", version: "0.1.0" }
notifications/initialized202 empty
notifications/cancelled202 empty
ping{}
tools/listFive tools
tools/call{ name, arguments } → text content JSON

​
Other verbs

MethodBehavior
GET405 (no SSE) when authenticated
DELETE204

​
Discovery

Clients should fetch protected resource metadata then complete the OAuth flow.
  • Resource: https://mcp.costmcp.com
  • Authorization server: https://api.costmcp.com
curl -X POST https://mcp.costmcp.com \
  -H "Authorization: Bearer $COSTMCP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "tools/list",
    "params": {}
  }'