Agents

MCP server

A stateless Model Context Protocol server over Streamable HTTP. Point any MCP client at it and the agent gets six tools scoped to one workspace.

Endpoint

text

https://mcp.echoia.io/mcp

Authenticate with the same token as the REST API. There are two ways to present it, because MCP clients differ in what they support.

Clients that send headers

Claude Code, Cursor, VS Code, Codex, Gemini CLI and most SDKs. This is the preferred route — the key stays in a header rather than a URL.

Claude Code

shell

claude mcp add --transport http echoia \
  https://mcp.echoia.io/mcp \
  --header "Authorization: Bearer $ECHOIA_API_KEY"

Cursor

.cursor/mcp.json

{
  "mcpServers": {
    "echoia": {
      "url": "https://mcp.echoia.io/mcp",
      "headers": { "Authorization": "Bearer eko_..." }
    }
  }
}

VS Code

.vscode/mcp.json

{
  "servers": {
    "echoia": {
      "type": "http",
      "url": "https://mcp.echoia.io/mcp",
      "headers": { "Authorization": "Bearer eko_..." }
    }
  }
}

Codex

~/.codex/config.toml

[mcp_servers.echoia]
url = "https://mcp.echoia.io/mcp"
http_headers = { "Authorization" = "Bearer eko_..." }

Clients that cannot send headers

claude.ai connectors and ChatGPT take a URL and nothing else. For those, the key goes in the path:

text

https://mcp.echoia.io/mcp/eko_your_key_here

That URL is the credential

Anyone holding it has whatever the token allows. Keep it in a password manager, never in a shared doc, a ticket or a screenshot. If it escapes, revoke the token — it takes effect on the next request.

The tools

Six, listed in full on the tool reference. The client only sees the ones the token's scopes allow, so an agent never plans around a tool it will be refused.

Tool	Scope
`list_accounts`	`read`
`list_posts`	`read`
`get_post_stats`	`read`
`create_post`	`write` (+ `publish`)
`list_comments`	`read`
`reply_to_comment`	`engage`

Protocol notes

JSON-RPC 2.0 over a single POST. No SSE stream, no session id.
Fully stateless — every request stands alone, which matches the 2026-07-28 direction of the MCP specification. The classic initialize handshake is still answered for existing clients; it just creates no server state.
Protocol versions 2025-03-26, 2025-06-18 and 2026-07-28 are accepted.
GET and DELETE return 405. Batch requests are refused.

Verify the connection

Without a client, a plain HTTP call tells you whether the token works:

curl

curl -X POST https://mcp.echoia.io/mcp \
  -H "Authorization: Bearer $ECHOIA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

A valid token returns the tools your scopes allow. An invalid one returns 401 with a message pointing at Settings → Developers.

Pair it with the skill

MCP gives the agent the ability to act. The agent skill gives it the judgement about when — which matters most for the two tools that act publicly.

Was this page helpful?