# MCP

The same 44 operations, as tools an assistant can call.

The Model Context Protocol is how an AI assistant reaches a system without anyone writing code. Posttar serves one at `https://mcp.posttar.com`, and every tool there is an endpoint of this API: same operations, same names, same refusals. Nothing exists in one and not in the other.

## Connecting

In an assistant that takes a connector (Claude, ChatGPT), paste the address and authorize in the browser. The assistant registers itself, you pick which workspace it may reach, and no key is copied anywhere.

In a client where you can set headers (an editor, a terminal), use the same address with an API key in `Authorization: Bearer`. It is the key from **Settings → API & MCP**, the same one this API takes.

Claude Code, with a key:

```bash
claude mcp add --transport http posttar https://mcp.posttar.com \
  --header "Authorization: Bearer $POSTTAR_KEY"
```

## What the server does, and what it does not

|  | Answer |
| --- | --- |
| Transport | Streamable HTTP. One `POST`, one JSON reply. |
| Session | None. Every call carries its own credential, and nothing is remembered between them. |
| Tools | One per endpoint. `GET /posts` is `get_posts`, `POST /posts` is `post_posts`. |
| Resources and prompts | Not offered. The server declares only `tools`. |
| Server-initiated stream | `GET` answers `405`: there is nothing the server needs to say on its own. |

> A tool that refuses answers with the refusal, not with a protocol error: the same `code` and `message` this API returns, so the assistant can read what went wrong and fix the call instead of giving up.

## Authorization

OAuth 2.1 with PKCE, discovery included: `https://mcp.posttar.com/.well-known/oauth-protected-resource` says who authorizes, and the authorization server publishes its own metadata. Clients register themselves. Access tokens last an hour and refresh tokens rotate, so a refresh token used twice ends the whole connection.

A connection belongs to one workspace, like a key does. You can see and disconnect what you authorized in **Settings → API & MCP**.