Connection contract
Use these values when a client supports remote MCP servers with custom headers:
Configuration field names vary by client. Select Streamable HTTP, enter the URL, and attach the Authorization header. Do not copy a generic nested
transport object unless your client’s own documentation specifies that shape.
Stdio-only clients
If the client only launches local commands, bridge it withmcp-remote:
--body-timeout 0 permits tool calls longer than five minutes.
Test the endpoint directly
An MCP request must include the Authorization, Accept, and Content-Type headers:Expected HTTP behavior
POST /mcphandles MCP requests.GET /mcpreturns 405 because Bilt has no standalone server-push stream.- Requests without a valid Bearer key return 401.
- Rate-limited requests return 429 with
X-RateLimit-*headers.
Migrating from legacy SSE
The/mcp/sse endpoint has been removed. Change the URL to /mcp, select Streamable HTTP, and disable SSE fallback. Existing tool names and input fields are unchanged.
Security
- Store the API key in an owner-readable personal configuration or secret store.
- Never commit it in a shared MCP configuration.
- Do not paste the key into support tickets or debug logs.
- Revoke and regenerate the key if it may have been exposed.
