Call the remote MCP server directly.

What does the endpoint accept?

Every request follows the same rules, whichever protocol version you use:

• POST only. A GET returns 405 with Allow: POST, and there are no sessions or Mcp-Session-Id headers.
• Authorization: Bearer YOUR_WORKSPACE_TOKEN on every request.
• One JSON-RPC 2.0 message per request, up to 150,000 bytes. A batch sent as a JSON array is rejected.
• No Origin header, or the app’s own. A request carrying another website’s Origin header gets 403, which keeps web pages from calling the server through a visitor’s browser.
• Replies are application/json with Cache-Control: no-store. Notifications, whose methods start with notifications/, get 202 with no body.
• Methods: initialize, in the 2025-11-25 style only, server/discover, which reports 2026-07-28 as its supported version with its capabilities, ping, tools/list and tools/call.
• serverInfo names the server kawl-now, with the display title Kawl Now and version 0.1.0. That version is separate from the REST API’s.

Which protocol versions does it support?

Two styles of request work, and neither needs a session:

• 2026-07-28: send MCP-Protocol-Version: 2026-07-28 and Mcp-Method with the method name, plus Mcp-Name with the tool name on tools/call. The body’s params._meta must carry io.modelcontextprotocol/protocolVersion set to 2026-07-28 and an io.modelcontextprotocol/clientCapabilities object. Results add resultType: "complete" and the server’s details in _meta.
• 2025-11-25: initialize answers with protocolVersion 2025-11-25, capabilities.tools and serverInfo, even when the client asked for 2025-06-18 or 2025-03-26. Requests that name no version are handled the same way, and any other version gets error -32022.

curl -X POST 'https://app.kawlnow.com/api/mcp' \
  -H 'Authorization: Bearer YOUR_WORKSPACE_TOKEN' \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -H 'MCP-Protocol-Version: 2026-07-28' \
  -H 'Mcp-Method: tools/list' \
  -d '{"jsonrpc": "2.0", "id": 1, "method": "tools/list", "params": {"_meta": {"io.modelcontextprotocol/protocolVersion": "2026-07-28", "io.modelcontextprotocol/clientCapabilities": {}}}}'

curl -X POST 'https://app.kawlnow.com/api/mcp' \
  -H 'Authorization: Bearer YOUR_WORKSPACE_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc": "2.0", "id": 2, "method": "tools/call", "params": {"name": "get_installation", "arguments": {"channel": "sales"}}}'

{
  "jsonrpc": "2.0",
  "id": 2,
  "result": {
    "content": [
      {
        "type": "text",
        "text": "{\"channel\":\"sales\",\"embed\":\"<script src=\\\"https://app.kawlnow.com/widget.js\\\" data-helpline=\\\"YOUR_WORKSPACE_ID\\\" data-channel=\\\"sales\\\" async></script>\",\"allowedOrigins\":[\"https://www.example.com\"],\"enabled\":false}"
      }
    ],
    "isError": false
  }
}

How are results shaped?

Every tool returns its result as JSON inside one text item, so parse result.content[0].text. A tool that fails still returns a result, with isError set to true and a plain-language message as the text.

tools/list returns each tool’s name, description and inputSchema, a JSON Schema object that doesn’t allow extra properties. Tools that only read data also carry annotations.readOnlyHint set to true, a hint some clients use when deciding whether to ask before running a tool.

Which JSON-RPC errors can it return?

Problems with the request itself return a JSON-RPC error object with one of these codes. Token and Origin errors happen before the body is read, so their id is null.