MCP HTTP Endpoints

​

Unified Endpoint

• Endpoint: http://localhost:3000/mcp
• Method: POST

​

Group-Specific Endpoint

• Endpoint: http://localhost:3000/mcp/{group}
• Method: POST
• Parameters:
  • {group}: The ID or name of the group.

​

Server-Specific Endpoint

• Endpoint: http://localhost:3000/mcp/{server}
• Method: POST
• Parameters:
  • {server}: The name of the server.

Note: If a server name and group name are the same, the group will take precedence.

​

Protocol compatibility

​

Elicitation forwarding

​

Migrating a client

1. Replace the legacy SSE client transport with an HTTP transport, and change /sse to /mcp, preserving any group, server or user route scope. Keep the same bearer credentials. A legacy HTTP client can make this transport change while retaining its initialization and session lifecycle.
2. To adopt 2026-07-28, use a client that supports modern HTTP discovery and the per-request metadata envelope. The SDK v2 HTTP client supplies the protocol and routing headers. A custom client must send the normal JSON-RPC body with params._meta["io.modelcontextprotocol/protocolVersion"] set to 2026-07-28 and declare client capabilities under params._meta["io.modelcontextprotocol/clientCapabilities"]. Send matching MCP-Protocol-Version and Mcp-Method headers; tools/call and prompts/get require Mcp-Name matching params.name, and resources/read requires it matching params.uri. Use names returned by that route’s list response.
3. For perSessionClient or OpenAPI cookieSession tools, create a UUID v4 for each independent workflow and send it as X-MCPHub-State-Id on tool calls. Authenticated OpenAI/ChatGPT tool calls that cannot set this extension may instead reuse their client-declared _meta["openai/session"] conversation hint when the explicit header is absent. MCPHub hashes that hint before use; it is correlation metadata, not authentication. An invalid explicit state header fails closed and never falls back. Stateless tools need neither value. Reuse is limited to the same bearer credential, user and route. State is process-local, expires after 30 idle minutes, and requires sticky routing across replicas. Restart, expiry or credential/route changes require rebuilding application state. See explicit-state configuration.
4. Verify listing and calling tools with your actual permissions, then verify resource reads and MCP Apps if used. Modern Apps hosts must declare their UI capability on each request. Modern calls do not depend on Mcp-Session-Id or enableSessionRebuild; those remain legacy mechanisms.

​

Cache behavior

​

Legacy SSE deprecation plan

​

Preserve route scope and authentication

import { Client } from '@modelcontextprotocol/sdk/client/index.js';
import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';

const client = new Client({ name: 'my-client', version: '1.0.0' });
await client.connect(
  new StreamableHTTPClientTransport(new URL('https://hub.example.com/alice/mcp/my-group-id'), {
    requestInit: { headers: { Authorization: 'Bearer YOUR_EXISTING_KEY' } },
  }),
);
const tools = await client.listTools();
// Use the returned tool names; retain this client for the workflow.
await client.close();

​

Readiness and removal boundaries

• The release containing the public notice and its actual date, plus proof that at least 12 calendar months will have elapsed at removal.
• Passing legacy SSE and Streamable HTTP compatibility suites throughout the window, including authenticated global, group, server and user routes, session continuation/rebuild and stateful-tool isolation.
• A migration checklist for each documented client integration: HTTP transport, preserved route/authentication, successful listing/calling, and resources, Apps or stateful workflows where used. Record tested client versions and unresolved blockers; there must be zero unresolved release-blocking migration defects. Operator confirmations may supplement this checklist; absence of telemetry is not evidence that nobody uses SSE.
• Published release notes and documentation in both languages, the 90-day and 30-day reminders, and a support path for deployments that still use SSE.