HTTPSTATUS Open workspace

02 / Tools for AI clients

Connect API reliability workflows to the assistants your team already uses

HTTPStatus MCP exposes focused API capabilities to compatible AI clients with clear authentication, inspectable tools, and practical setup guides.

Open MCP toolsView setup guides

Verified implementation reference

Connect to the server, inspect the protocol, then call a real tool.

Examples on this page match the HTTPStatus MCP server implementation.

Endpointhttps://mcp.httpstatus.com/mcp
TransportStreamable HTTP
AuthenticationOAuth 2.0 + PKCE or personal bearer token
Payload limit1 MiB default
Default timeout20 seconds
Default limits120 global / 60 per-tool calls per minute

Authentication and discovery

OAuth is the recommended path for compatible clients.

The MCP resource advertises its authorization server through RFC 9728 metadata. HTTPStatus publishes RFC 8414 authorization-server metadata, supports dynamic client registration, and uses the authorization-code grant with PKCE S256 for public clients.

01 / Resource discovery

Protected resource metadata

GET https://mcp.httpstatus.com/.well-known/oauth-protected-resource

{
  "resource": "https://mcp.httpstatus.com",
  "authorization_servers": ["https://httpstatus.com"],
  "scopes_supported": [
    "tools.read", "tools.execute", "resources.read"
  ],
  "bearer_methods_supported": ["header"]
}
02 / Authorization server

OAuth endpoints and PKCE

GET https://httpstatus.com/.well-known/oauth-authorization-server

authorization_endpoint  /oauth/authorize
token_endpoint          /oauth/token
registration_endpoint   /oauth/register
grant                    authorization_code
PKCE                     S256
client auth              none | client_secret_post
Personal token alternative

Create a revocable token in MCP Access Tokens, then send it as Authorization: Bearer mcp_<token>. OAuth-issued access tokens use the same bearer header. Do not put either token in a URL or commit it to source control.

Protocol exchange

Initialization is required before tool calls.

1

Initialize a Streamable HTTP session

POST /mcp HTTP/1.1
Host: mcp.httpstatus.com
Authorization: Bearer <access_token>
Content-Type: application/json

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "initialize",
  "params": {
    "protocolVersion": "2025-03-26",
    "capabilities": {},
    "clientInfo": { "name": "my-mcp-client", "version": "1.0.0" }
  }
}

Retain the Mcp-Session-Id response header and send it on subsequent requests with the same bearer token.

2

List the server’s tools

{
  "jsonrpc": "2.0",
  "id": 2,
  "method": "tools/list",
  "params": {}
}
3

Create a runnable mock

{
  "jsonrpc": "2.0",
  "id": 3,
  "method": "tools/call",
  "params": {
    "name": "create_mock",
    "arguments": {
      "name": "Order lookup",
      "urlPattern": "/api/orders/{id}",
      "method": "GET",
      "statusCode": 200,
      "responseBody": { "id": "ord_1042", "status": "paid" },
      "isPublic": false
    }
  }
}

A private mock response includes endpoint access guidance. Calls to the mock require its separate X-API-Key; the MCP OAuth or personal token authenticates the tool call, not the generated mock endpoint.

Tool catalogue

Twenty-four tools, grouped by the work they perform.

The live tools/list response is authoritative. This catalogue reflects the definitions registered by the current server build.

Mocks

create_mock · update_mock · delete_mock · list_mocks

Chaos

create_chaos_rule · disable_chaos_rule · list_chaos_rules

HTTP diagnostics

run_redirect_analyzer · run_cors_debug · check_ssl · analyze_har

API quality

validate_openapi · run_security_scan · run_trace · decode_jwt

Automation

automation_create_workflow · automation_generate_from_openapi · automation_import_postman_collection · automation_run_workflow · automation_get_workflow_status

Operations

create_monitor · get_monitor_status · capture_webhook · start_resolve
Actual input schemacreate_mock
{
  "type": "object",
  "required": ["name", "urlPattern", "method", "statusCode"],
  "properties": {
    "name": { "type": "string" },
    "urlPattern": { "type": "string" },
    "method": {
      "type": "string",
      "enum": ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]
    },
    "statusCode": { "type": "integer", "minimum": 100, "maximum": 599, "default": 200 },
    "responseBody": {},
    "responseHeaders": { "type": "object", "additionalProperties": { "type": "string" } },
    "delayMs": { "type": "integer", "minimum": 0, "maximum": 120000 },
    "active": { "type": "boolean" },
    "isPublic": { "type": "boolean" },
    "priority": { "type": "integer", "minimum": 0, "maximum": 10000 },
    "requestType": { "type": "string", "enum": ["REST", "GraphQL"] },
    "matchType": { "type": "string" }
  },
  "additionalProperties": false
}

Troubleshooting

Exact failures returned by the current server.

ErrorMeaningResolution
401 · Bearer token required for /mcpNo OAuth access token or personal MCP token was sent.Complete OAuth discovery/consent or add the Authorization header.
400 · Initialization required before using MCP sessionA request other than initialize started a session.Initialize first and retain the returned session ID.
404 · Session not foundThe Mcp-Session-Id is missing from server memory or is no longer valid.Start a new initialization exchange.
401 · token does not match MCP sessionA session was reused with a different bearer token.Use the same token as initialization or create a new session.
413 · payload_too_largeTool arguments exceed the configured payload limit.Reduce the artifact below the advertised limit.
429 · rate_limit_exceededThe global or per-tool rate guard rejected the call.Respect retryAfterMs and reduce call frequency.
400 · invalid_requestArguments failed the registered schema or the tool name is unknown.Refresh tools/list and validate required fields and types.

Production checklist

  • Prefer OAuth with PKCE when the client supports discovery.
  • Give personal tokens a client-specific name and revoke unused tokens.
  • Review each tool’s annotations before enabling write-capable operations.
  • Keep the bearer token stable for the lifetime of a Streamable HTTP session.
  • Log JSON-RPC IDs, tool names, HTTP status, latency, and sanitized errors—not credentials or sensitive payloads.

Continue the path

API agentsEvaluate agents by their tool actions.API mocksCreate mock APIs through bounded tooling.Integrate APIUse direct API calls when MCP is not the right layer.DocumentationFind setup and authentication guidance.

Next move

Start with one concrete API problem.

Keep the first step small. Move into a workspace when the result deserves to be saved, repeated, or shared.

Open MCP toolsTalk to a human