MCP endpoint for AI agents

What the platform MCP endpoint does

https://socket.help/mcp is a Model Context Protocol server that gives an agent the same capabilities as the HTTP API: run any executable utility, and create, inspect, renew, share and delete temporary resources. It shares permissions and quotas with HTTP, so an agent using your API key works within your workspace plan.

This endpoint is different from a mock MCP server. The platform endpoint exposes socket.help itself; a mock MCP server at /mcp/mock/{id} returns tools and responses you configure.

Connect a client

Configure your client for Streamable HTTP with the URL https://socket.help/mcp. Add Authorization: Bearer with an API key to use your workspace; without it the agent works anonymously. Initialize before calling tools.

Requests are POST with Accept: application/json, text/event-stream. Responses are plain JSON. GET returns 405 because SSE streams and transport sessions are not provided. Supported protocol versions are 2025-11-25, 2025-06-18 and 2025-03-26. Platform request bodies can be up to 16 MiB, including Base64 file input, with four concurrent requests admitted before body parsing. Individual file limits still apply.

curl https://socket.help/mcp \
  -H "Authorization: Bearer $SOCKET_HELP_API_KEY" \
  -H 'Accept: application/json, text/event-stream' \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{
    "name":"run_tool",
    "arguments":{"toolId":"json","input":"{\"hello\":true}"}
  }}'

Available tools

tools/list returns these tools with input schemas and annotations. Tool results are text content containing JSON.

Credentials inside tool calls

The inspect_* and delete_* tools require id and token: the inspection or management token returned at creation. For workspace resources created with the connection’s API key, resource_request works without a token. download_temporary_file takes the private access token as accessToken, separate from the management token.

resource_request takes kind (inboxes, mocks, files or mcp-servers), action (create, inspect, update, delete, renew, sharing or list), and optionally id, token, config, ttlSeconds, persistent and visibility. It calls the same HTTP endpoints, so its results match the HTTP responses.

Errors

Invalid arguments return a JSON-RPC error with code -32602, and unknown methods return -32601. API errors such as quota or permission failures come back as a tool result with isError: true and a JSON body containing error and status.