Docs MCP (1.0.0)
Connect AI assistants to your project's Docs MCP server to browse API descriptions, inspect endpoints, and search documentation content.
Base URL: The Docs MCP server is available at /mcp on your project host. If your project is deployed under a path prefix, prepend that prefix to /mcp.
Public endpoint: Projects that enable mcp.docs.publicEndpoint also serve /mcp-public. That endpoint requires no login and serves only the content that RBAC grants to the anonymous team.
For setup and configuration guidance, see Model Context Protocol server and MCP configuration reference.
Public projects can expose Docs MCP without authentication.
If your project requires login (rbac or requiresLogin configured), Docs MCP Server requires the user to authenticate using the configured method. This requirement ensures that AI Agents can only access APIs and operations the authenticated user has permission to view.
The whoami tool is only available when authentication handling is enabled for the Docs MCP server.
The /mcp-public endpoint never challenges for authentication. It ignores any credentials the client sends and serves only the content available to the anonymous team.
Every request carries its own token, and the server validates that token on each request. The server checks the signature against the identity provider that issued the token, checks the expiry, and compares the aud (audience) claim to your organization ID.
A token whose aud names a different organization is recorded and, when audience enforcement is on for your project, rejected with a 401 response. Enforcement is off by default, and MCP configuration reference names the environment variable that turns it on.
Two cases skip the audience comparison. Tokens that carry no aud claim are accepted, because portal session tokens and tokens from some identity provider setups don't set one. Projects that run without an organization ID, such as self-hosted deployments, have nothing to compare against.
A token isn't sufficient to determine what content is served. RBAC decides which content and API descriptions the request can reach.