MCP · Streamable HTTP

Project references, available to your tools.

Sourcefolio provides normalized open-source metadata and a private project-reference workspace through a remote Model Context Protocol server.

Server URLhttps://mcp.sourcefolio.io/mcp

TransportStreamable HTTP

AuthenticationPer-developer bearer key

Quickstart

Add the server URL and bearer header to any client supporting remote Streamable HTTP MCP:

{
  "url": "https://mcp.sourcefolio.io/mcp",
  "transport": "streamable-http",
  "headers": {
    "Authorization": "Bearer ${SOURCEFOLIO_API_KEY}"
  }
}

Confirm reachability independently of authentication:

curl https://mcp.sourcefolio.io/healthz
# {"status":"ok"}

Authentication

API keys are issued per developer and map to one isolated Sourcefolio workspace. Store the key as a secret and send it on every MCP request.

Authorization: Bearer sfk_...

Keys are read-only by default. Workspace mutation requires a separately issued key containing the workspace:write permission.

Key lifecycle

Do not place keys in source control, URLs, or client logs.
Use separate keys for local development, CI, and each collaborator.
Ask your workspace administrator to revoke and replace a lost key.

Access administration

Each developer uses an individually issued credential connected to one workspace. Company-wide shared keys are not supported.

Workspace owners manage members, roles, and credential lifecycle through the workspace administration portal. These controls are intentionally outside MCP so connected tools cannot grant access or rotate credentials.

Tools

Tool	Purpose	Permission
`search_public_projects`	Search normalized public project metadata.	`catalog:read`
`get_public_project`	Retrieve one public project record.	`catalog:read`
`list_workspace_projects`	List projects saved in your workspace.	`workspace:read`
`get_workspace_project`	Retrieve one saved workspace project.	`workspace:read`
`add_workspace_project`	Add a project and release metadata.	`workspace:write`
`update_workspace_project`	Update a saved project.	`workspace:write`
`remove_workspace_project`	Remove a saved project.	`workspace:write`
`get_current_identity`	Describe the authenticated developer credential and its access.	Authenticated
`get_current_workspace`	Describe the credential's associated workspace and role.	`workspace:read`
`record_adoption_decision`	Add an attributed recommendation and decision notes.	`workspace:write`
`list_adoption_decisions`	Read recommendations and notes from workspace members.	`workspace:read`
`set_project_status`	Set the workspace's official adoption status.	`workspace:write`

Decision workflow

Members can record independent recommendations as evaluating, approved, rejected, or retired. Each entry retains its author and notes, while the project status represents the workspace's current official decision.

Protocol notes

Send MCP messages to POST /mcp using JSON-RPC 2.0.
Advertise both application/json and text/event-stream in Accept.
Capture the mcp-session-id response header after initialization and return it on subsequent requests.
The current tested MCP protocol version is 2025-06-18.

Content-Type: application/json
Accept: application/json, text/event-stream
mcp-session-id: <session returned by initialize>

Errors

Status	Meaning
`400`	Invalid MCP message or protocol version.
`401`	API key is missing, invalid, expired, or revoked.
`404`	MCP session is missing or no longer available.
`406`	Required Streamable HTTP response types were not accepted.