# MCP

> MCP endpoint (Streamable HTTP, JSON responses)

**Endpoint:** `POST /mcp`  
**Access:** Public (no credentials needed)

JSON-RPC 2.0. Anonymous tools work without credentials; account tools take an API key or WorkOS OAuth token (401 + `WWW-Authenticate` triggers OAuth). Guide: https://getverifiedinbox.com/docs/mcp

## cURL example

```bash
curl -X POST "https://api.verifiedinbox.ai/mcp" \
  -H "Content-Type: application/json" \
  -d '{}'
```

## Request body

```json
{}
```

## Responses

### 200 OK

JSON-RPC response(s).

```json
{}
```

### 202 OK

Notifications accepted.

### 400 (invalid_request)

`invalid_request` — the request is malformed.

```json
{
  "error": {
    "code": "invalid_request",
    "message": "Please provide a valid domain name."
  }
}
```

### 422 (unprocessable)

`unprocessable` / `blocked_provider` — understood but can't be done (plain-English reason).

```json
{
  "error": {
    "code": "unprocessable",
    "message": "Shared mailbox providers like gmail.com cannot be verified."
  }
}
```

### 429 (rate_limited)

`rate_limited` — retry after `Retry-After` seconds (`details.retry_after_seconds`). `limit_reached` — a quota is used up; `details.limit` names it and `next_action` offers support.

```json
{
  "error": {
    "code": "rate_limited",
    "message": "Too many requests. Please wait a moment and try again."
  }
}
```