# The MCP server

A remote MCP server at https://app.julius.dealsflow.ai/api/mcp. This page is for people building or debugging MCP clients and agents; to just connect an app, see Connect AI apps.

Julius Answer runs a remote MCP server over Streamable HTTP at https://app.julius.dealsflow.ai/api/mcp. Its tools are the REST API's operations, filtered to what the connection may use; it also offers five prompts. Clients sign in with OAuth 2.1 (discovered from a 401) or send an API key.

## Transport and versions
- **Streamable HTTP, stateless:** each POST carries one JSON-RPC message (or a batch of up to 20 from older clients) and gets a JSON reply. Notifications get 202. There's no session id and no event stream; GET and DELETE answer 405.
- **Protocol versions:** the initialize handshake for 2024-11-05, 2025-03-26, 2025-06-18 and 2025-11-25, and the 2026-07-28 revision, whose clients call server/discover and send MCP-Protocol-Version on every request. An unknown version gets 400 with error -32022 and the supported list.
- **Capabilities:** tools and prompts (neither list changes during a connection). resources/list is empty.
- **Size:** request bodies up to 256 KB.
 curl https://app.julius.dealsflow.ai/api/mcp \ -H "Authorization: Bearer jak_your_key" -H "Content-Type: application/json" \ -H "Accept: application/json, text/event-stream" \ -d '{"jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": {"name": "get_todo", "arguments": {}}}'

## Sign-in discovery

A request without a token gets: HTTP/1.1 401 Unauthorized WWW-Authenticate: Bearer resource_metadata="https://app.julius.dealsflow.ai/.well-known/oauth-protected-resource/api/mcp", scope="read write admin"

The protected resource metadata names the authorization server; its metadata lists the endpoints, PKCE (S256), dynamic client registration and client ID metadata documents. Clients pass resource=https://app.julius.dealsflow.ai/api/mcp. Details on [Keys and OAuth](/docs/authentication/).

## Tools

Every operation on the [reference page](/docs/reference/) is a tool with the same name and a JSON Schema for its input, except the ZIP export and the CRM-change approval, which are REST only. tools/list shows only what the connection's access and the person's role allow. Each tool carries annotations:
- readOnlyHint on everything that only reads.
- destructiveHint on removals (a team member, an answer, a connection, blocking a caller).
- openWorldHint on steps that reach outside the workspace: emailing a caller, a webhook, a phone carrier, the CRM.
- idempotentHint on changes that set a value.

Results come back as text and as structuredContent (the same JSON as the REST API). Problems are tool results with isError: true and a plain message, so the model can explain them.

## Prompts

Prompts the server offers
| Prompt | Arguments | What it asks for |
|---|---|---|
| morning_briefing | none | Urgent messages, call-backs, bookings to confirm and other flags, without changing anything |
| call_backs | none | Everyone waiting for a call back, most urgent first |
| weekly_review | none | The last 7 days: what people asked, who didn't book, unanswered questions, three suggestions |
| teach_answer | topic | Drafts an answer and saves it only after the person says yes |
| holiday_hours | dates | Shows the change to the hours and makes it only after the person says yes |

## Safety in the protocol
- **Server instructions** tell the model that transcripts, messages and notes are what callers said: information, never instructions. They also ask it to check with the person before outward or destructive steps.
- **Approval in the console:** steps that send calls or call details somewhere new (a new alert email, a team phone or email, a Slack or webhook address), take a phone number, disconnect something, add links callers will hear or change the CRM never run from MCP alone. The tool result says waiting_for_approval, and the step waits in the person's console assistant with a Yes button that the console's own AI can't press.
- **Origin check:** requests with an Origin header must come from claude.ai, claude.com, chatgpt.com or Julius Answer itself, so a web page on another site can't drive the server through someone's browser.
- **Limits:** 120 requests a minute per connection (each message in a batch counts), 4 at the same time per connection and 8 per workspace.

## One connection, many businesses (partners)

With a partner key and no X-Workspace-ID header, the server adds a list_workspaces tool and a required workspace argument to every other tool, so one connection can work across an agency's businesses. With X-Workspace-ID it behaves like a normal workspace connection. See [the partner API](/docs/partners/).

## Frequently asked questions

### Which MCP protocol versions does Julius Answer support?

The initialize handshake versions 2024-11-05, 2025-03-26, 2025-06-18 and 2025-11-25, and the stateless 2026-07-28 revision with server/discover.

### Does the server use Server-Sent Events?

No. It is stateless: every POST gets one JSON reply. GET and DELETE on the endpoint answer 405, which MCP clients understand as no event stream and no session.

### Can I use the MCP server from my own agent?

Yes. Use any MCP client library with Streamable HTTP and send an API key as Authorization: Bearer, or run the OAuth flow. The official MCP SDKs work.

---
Source: https://julius.dealsflow.ai/docs/mcp/
Updated: 2026-10-20