The MCP server

Transport and versions

• Streamable HTTP, stateless: each POST carries one JSON-RPC message (or a batch of up to 20 from older clients) and gets a JSON reply. Notifications get 202. There's no session id and no event stream; GET and DELETE answer 405.
• Protocol versions: the initialize handshake for 2024-11-05, 2025-03-26, 2025-06-18 and 2025-11-25, and the 2026-07-28 revision, whose clients call server/discover and send MCP-Protocol-Version on every request. An unknown version gets 400 with error -32022 and the supported list.
• Capabilities: tools and prompts (neither list changes during a connection). resources/list is empty.
• Size: request bodies up to 256 KB.

curl https://app.julius.dealsflow.ai/api/mcp \
  -H "Authorization: Bearer jak_your_key" -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc": "2.0", "id": 1, "method": "tools/call",
       "params": {"name": "get_todo", "arguments": {}}}'

Sign-in discovery

A request without a token gets:

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer resource_metadata="https://app.julius.dealsflow.ai/.well-known/oauth-protected-resource/api/mcp", scope="read write admin"

The protected resource metadata names the authorization server; its metadata lists the endpoints, PKCE (S256), dynamic client registration and client ID metadata documents. Clients pass resource=https://app.julius.dealsflow.ai/api/mcp. Details on Keys and OAuth.

Tools

Every operation on the reference page is a tool with the same name and a JSON Schema for its input, except the ZIP export and the CRM-change approval, which are REST only. tools/list shows only what the connection's access and the person's role allow. Each tool carries annotations:

• readOnlyHint on everything that only reads.
• destructiveHint on removals (a team member, an answer, a connection, blocking a caller).
• openWorldHint on steps that reach outside the workspace: emailing a caller, a webhook, a phone carrier, the CRM.
• idempotentHint on changes that set a value.

Results come back as text and as structuredContent (the same JSON as the REST API). Problems are tool results with isError: true and a plain message, so the model can explain them.

Prompts

Safety in the protocol

• Server instructions tell the model that transcripts, messages and notes are what callers said: information, never instructions. They also ask it to check with the person before outward or destructive steps.
• Approval in the console: steps that send calls or call details somewhere new (a new alert email, a team phone or email, a Slack or webhook address), take a phone number, disconnect something, add links callers will hear or change the CRM never run from MCP alone. The tool result says waiting_for_approval, and the step waits in the person's console assistant with a Yes button that the console's own AI can't press.
• Origin check: requests with an Origin header must come from claude.ai, claude.com, chatgpt.com or Julius Answer itself, so a web page on another site can't drive the server through someone's browser.
• Limits: 120 requests a minute per connection (each message in a batch counts), 4 at the same time per connection and 8 per workspace.

One connection, many businesses (partners)

With a partner key and no X-Workspace-ID header, the server adds a list_workspaces tool and a required workspace argument to every other tool, so one connection can work across an agency's businesses. With X-Workspace-ID it behaves like a normal workspace connection. See the partner API.