Skip to main content

Connection contract

Use these values when a client supports remote MCP servers with custom headers: Configuration field names vary by client. Select Streamable HTTP, enter the URL, and attach the Authorization header. Do not copy a generic nested transport object unless your client’s own documentation specifies that shape.

Stdio-only clients

If the client only launches local commands, bridge it with mcp-remote:
The header argument intentionally contains no space after the colon. This avoids argument splitting in Cursor and Claude Desktop on Windows. --body-timeout 0 permits tool calls longer than five minutes.

Test the endpoint directly

An MCP request must include the Authorization, Accept, and Content-Type headers:
A successful response is an SSE-formatted JSON-RPC initialization result. The SSE response belongs to this POST request; it is not a separate persistent SSE endpoint.

Expected HTTP behavior

  • POST /mcp handles MCP requests.
  • GET /mcp returns 405 because Bilt has no standalone server-push stream.
  • Requests without a valid Bearer key return 401.
  • Rate-limited requests return 429 with X-RateLimit-* headers.

Migrating from legacy SSE

The /mcp/sse endpoint has been removed. Change the URL to /mcp, select Streamable HTTP, and disable SSE fallback. Existing tool names and input fields are unchanged.

Security

  • Store the API key in an owner-readable personal configuration or secret store.
  • Never commit it in a shared MCP configuration.
  • Do not paste the key into support tickets or debug logs.
  • Revoke and regenerate the key if it may have been exposed.