Machine-readable copy: /.well-known/mcp.

Endpoint

ok: https://www.anwe.sh/api/mcp

Transport is Streamable HTTP. POST that URL. GET and DELETE on the same path are the MCP channel and still require the key. A request with no key is 401. A request with an Origin header or a query string is 403.

Headers

  • Authorization: Bearer anw_ key minted on Admin → Connections. The secret is shown once and is not on this page.
  • Accept: application/json, text/event-stream
  • Content-Type: application/json on POST
  • Origin: must be absent
  • Query string: must be absent

Methods

  • initialize
  • notifications/initialized returns HTTP 202
  • tools/list — tools/list returns the operations this key is allowed to call. Each tool has a name, a description, and a JSON input schema. A name outside the grant is denied.
  • tools/call — An approval-gated tools/call returns pending approval and approval_request_id. It does not perform the write.

ORA_SECRET authenticates and then fails closed. It has no operation grant and cannot write.

REST

ok: POST https://www.anwe.sh/api/v2/<operation> with the same bearer.

Example

curl -sS -X POST "https://www.anwe.sh/api/mcp" \
  -H "Authorization: Bearer $ANW_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"script","version":"1"}}}'

Put the anw_ secret in ANW_KEY. Do not send an Origin header.