MCP Developer Guide

Manifest

GET /api/mcp/manifest returns the public manifest. Read its advertised protocol and capabilities before configuring your client.

curl --max-time 30 \
  https://app.netshow.ai/api/mcp/manifest \
  -H 'Accept: application/json'

The public agent card is also available at GET /.well-known/agent-card.json; see the A2A guide for peer-agent discovery.

Sanctum bearer auth

POST /api/mcp is the authenticated JSON-RPC 2.0 endpoint. Use a NetShow Sanctum personal access token issued for your account through the owner's authorized credential workflow. Replace the literal <YOUR_TOKEN> locally; never paste a real token into documentation, shared logs or a recipe. A harness pairing session token is not a Sanctum credential.

List the tools visible to your authenticated caller:

curl --max-time 30 \
  https://app.netshow.ai/api/mcp \
  -H 'Accept: application/json' \
  -H 'Authorization: Bearer <YOUR_TOKEN>' \
  -H 'Content-Type: application/json' \
  --data '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}'

Use the returned tool names and input schemas when constructing tools/call requests. Tool visibility does not bypass owner approval, destination checks, feature availability or spend admission. Missing or invalid authentication returns 401; inspect JSON-RPC errors as well as the HTTP status.

Rate limits

MCP inherits the API limiter: 60 requests per minute per authenticated user, or per IP for public discovery. On 429, honor Retry-After before resuming. Bound client timeouts and cancel requests when the caller leaves. The A2A 20 per minute route throttle and its hourly buckets apply to A2A routes, not to this MCP endpoint.

Lane ceilings

For metered customer MCP execution: owner-set daily ceiling, zero means closed. Admission reads ai.spend.lanes.customer_mcp.daily_ceiling_usd; an exhausted or closed lane refuses execution. The general lookup shape is ai.spend.lanes.<lane>.daily_ceiling_usd. Public manifest discovery itself does not authorize spending. No live deployment ceiling or environment value is published here.

Owners can inspect their permitted tools at What the Harness can use. This discovery door requires sign-in, verification and the harness discovery feature; it returns 404 when unavailable. For a local connector, continue with Harness pairing, or find all three guides in the Help Center.