# Call Commentary MCP over Streamable HTTP JSON-RPC.

Authenticated tools/list advertises: commentary_agent_profile, inbox_saved_view, interaction, commentary_forms, commentary_research, github_app_access, draft_review, review_comments, web_app_review, r

Canonical: https://commentary.dev/docs/reference/api/post-mcp-json-rpc

`POST /mcp`

Authenticated tools/list advertises: commentary_agent_profile, inbox_saved_view, interaction, commentary_forms, commentary_research, github_app_access, draft_review, review_comments, web_app_review, review_participants, review_settings, review_polls, review_gate_status, review_document, brain_review, commentary_projects, commentary_trackers, review_package, project_review_session, codebase_review, project_evidence.

## Access

Use a credential with the authentication scheme documented in the API contract.

Provider access, workspace membership, and agent grants are enforced separately. A token does not expand access to a repository or resource. [Set up developer access](/docs/build/developer-access).

## Request body

Required. Supported content types: `application/json`.

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `jsonrpc` | `"2.0"` | Yes |  |
| `id` | string or number or null | No |  |
| `method` | `"initialize"` · `"notifications/initialized"` · `"tools/list"` · `"tools/call"` | Yes |  |
| `params` | object | No |  |

## Call the endpoint

Replace path placeholders and your credential. For body operations, create `request.json` using the required fields above; this command does not invent resource identifiers or consent.

```bash
curl --request POST \
  'https://commentary.dev/mcp' \
  --header 'Authorization: Bearer <your-token>' \
  --header 'Content-Type: application/json' \
  --data-binary @request.json
```

## Responses

| Status | Meaning | Payload |
| --- | --- | --- |
| `200` | JSON-RPC response. | object |
| `202` | Accepted JSON-RPC notification. | See response headers or body contract |
| `400` | Invalid JSON-RPC request. | object |
| `401` | Bearer authentication challenge. | object |
| `403` | Current-protocol insufficient-scope challenge with a JSON-RPC error body and WWW-Authenticate metadata. | object |

### Successful response fields

Value type: object.

## Recover from errors

Use the returned status and error body. Correct invalid fields before retrying; reconnect or narrow the target for authentication and permission errors. For conditional writes, reload the latest version before preparing a new request. Respect rate-limit headers and retry only when the operation’s idempotency contract permits it.

## Contract and related guidance

Operation ID: `postMcpJsonRpc`. [Download the OpenAPI contract](/docs/reference/openapi.json) for complete constraints and code generation. [Browse endpoints](/docs/reference/api-operations).