MCP · Streamable HTTP

Project references, available to your tools.

Sourcefolio provides normalized open-source metadata and a private project-reference workspace through a remote Model Context Protocol server.

Server URLhttps://mcp.sourcefolio.io/mcp

TransportStreamable HTTP

AuthenticationPer-developer bearer key

Quickstart

Add the server URL and bearer header to any client supporting remote Streamable HTTP MCP:

{
  "url": "https://mcp.sourcefolio.io/mcp",
  "transport": "streamable-http",
  "headers": {
    "Authorization": "Bearer ${SOURCEFOLIO_API_KEY}"
  }
}

Confirm reachability independently of authentication:

curl https://mcp.sourcefolio.io/healthz
# {"status":"ok"}

Authentication

API keys are issued per developer and map to one isolated Sourcefolio workspace. Store the key as a secret and send it on every MCP request.

Authorization: Bearer sfk_...

Keys are read-only by default. Workspace mutation requires a separately issued key containing the workspace:write permission.

Key lifecycle

Do not place keys in source control, URLs, or client logs.
Use separate keys for local development, CI, and each collaborator.
Ask your workspace administrator to revoke and replace a lost key.

Tools

Tool	Purpose	Permission
`search_public_projects`	Search normalized public project metadata.	`catalog:read`
`get_public_project`	Retrieve one public project record.	`catalog:read`
`list_workspace_projects`	List projects saved in your workspace.	`workspace:read`
`get_workspace_project`	Retrieve one saved workspace project.	`workspace:read`
`add_workspace_project`	Add a project and release metadata.	`workspace:write`
`update_workspace_project`	Update a saved project.	`workspace:write`
`remove_workspace_project`	Remove a saved project.	`workspace:write`

Protocol notes

Send MCP messages to POST /mcp using JSON-RPC 2.0.
Advertise both application/json and text/event-stream in Accept.
Capture the mcp-session-id response header after initialization and return it on subsequent requests.
The current tested MCP protocol version is 2025-06-18.

Content-Type: application/json
Accept: application/json, text/event-stream
mcp-session-id: <session returned by initialize>

Errors

Status	Meaning
`400`	Invalid MCP message or protocol version.
`401`	API key is missing, invalid, expired, or revoked.
`404`	MCP session is missing or no longer available.
`406`	Required Streamable HTTP response types were not accepted.