API Reference

Complete reference for the Fenceline MCP Server API endpoints and methods.

Base URL

https://mcp.fenceline.ai

Authentication

All MCP transport requests require an API key in the request header. Public discovery, documentation, and health endpoints don't require a key.

X-API-Key: YOUR_API_KEY

Streamable HTTP endpoint

URL: POST, DELETE /mcp

This is the recommended MCP transport. Start with an initialize request, then send the returned Mcp-Session-Id and negotiated Mcp-Protocol-Version headers on later requests. Send DELETE to terminate the session.

Compatibility JSON-RPC endpoint

URL: POST /mcp/rpc

Execute a single MCP tool request without creating a protocol session.

Request Format

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "tool_name",
    "arguments": {}
  }
}

Response Format

{
  "jsonrpc": "2.0",
  "id": 1,
  "result": {
    "content": [
      {
        "type": "text",
        "text": "Tool response data"
      }
    ]
  }
}

Discovery Endpoints

Server Information

URL: GET /

Returns comprehensive server information and capabilities.

Tools Catalog

URL: GET /mcp/tools.json

Returns complete catalog of available MCP tools with examples.

OpenAPI Specification

URL: GET /mcp/openapi.json

Returns OpenAPI 3.0 specification for the entire API.

Server Discovery

URL: GET /mcp/.well-known/mcp-server.json

Machine-readable server discovery endpoint for MCP aggregators.

Health and Status

Health Check

URL: GET /health

Returns server health status and uptime information.

MCP Info

URL: GET /mcp/info

Detailed information about MCP transports and capabilities.

Error Handling

The API uses standard HTTP status codes and JSON-RPC error responses:

HTTP Status Codes

200 - Success
400 - Bad Request
401 - Unauthorized
429 - Rate Limit Exceeded
500 - Internal Server Error

JSON-RPC Errors

{
  "jsonrpc": "2.0",
  "id": 1,
  "error": {
    "code": -32600,
    "message": "Invalid Request",
    "data": "Additional error information"
  }
}

Rate Limiting

Authenticated requests use a default per-contractor limit. Expensive tool categories have lower independent limits:

Default authenticated limit: 100 requests per minute per API key
RAG searches: 50 requests per minute per contractor
Rate limit headers: Included in authenticated responses

Interactive Testing

Use our Interactive Console to test API calls in real-time.