Connecting to the HIIE MCP server at /api/mcp
HIIE ships a Model Context Protocol (MCP) server so MCP-capable clients and agents can drive the platform through a standard interface.
Endpoint and protocol
The MCP server is at /api/mcp. It implements MCP over Streamable HTTP using JSON-RPC 2.0, advertises protocol version 2025-06-18, and identifies itself as server hiie-mcp version 1.0.0.
Authentication
The MCP server uses the same Bearer API-key chokepoint as the REST API. Headless clients send a HIIE developer key (hk_live_<id>.<secret>) as the Bearer token. Every call authenticates first and is owner-scoped to your account. A 401 response carries a WWW-Authenticate header pointing at the protected-resource metadata so clients can discover how to authenticate.
Transport notes
MCP here is POST JSON-RPC 2.0 only. There is no server-to-client SSE stream on this endpoint — a GET returns 405 when authenticated (or 401 when not). Configure your client for Streamable HTTP, not a separate event stream.
Discovery
The MCP server card (SEP-1649) is published at /.well-known/mcp/server-card.json. It advertises the streamable-http transport at the /api/mcp endpoint and oauth2 authentication with resource metadata; in practice headless clients authenticate with the hk_live_ API key as the Bearer token.
Scopes apply
Each MCP tool requires a scope (read, write, or build). If your key lacks the scope a tool needs, the call returns a forbidden error. See the companion article on the eight MCP tools and their scopes.
Note: the agent-facing discovery surfaces are served in production and return 404 outside it.