Endpoints
MCP server
| Environment | URL |
|---|---|
| Production | https://mcp.inbox.kobana.com.br |
| Sandbox | https://mcp.inbox.sandbox.kobana.com.br |
The server URL is the root of the host — that is the whole address you paste into an MCP client. It is also the OAuth resource identifier, which is why it carries no path.
Routes served
| Method | Path | Purpose |
|---|---|---|
POST | / | One JSON-RPC message per request. The entire tool surface. |
GET | /.well-known/oauth-protected-resource | Protected-resource metadata (RFC 9728). Public, unauthenticated. |
GET | / | 405 — this server is stateless and opens no server→client stream. |
DELETE | / | 204 — there are no sessions to terminate. |
| any | any other path | 404 with { "error": { "code": "not_found", "message": "not_found" } } — JSON, never an HTML page. |
Documentation
| URL | |
|---|---|
| Documentation | https://docs.inbox.kobana.com.br |
Each environment has its own host, database and audience: a token issued for one environment's MCP server is rejected by another — see Authentication.
:::info Separate host, on purpose The MCP server has its own host rather than a path on the API or app host. The API host requires mTLS, which no MCP client can satisfy; the OAuth discovery document has to live at the root of the host; and no dashboard cookie is ever sent to this origin, which removes a whole class of confused-deputy problems by construction. :::
Local development
In development the endpoint answers on /mcp on the app host (http://localhost:3028/mcp), and the discovery document on /.well-known/oauth-protected-resource. Outside development the host allow-list hides the endpoint (404) outside mcp.inbox.*.