Connectors and the MCP endpoint.

Endpoints

MobileB is both the resource server and the authorization server. Everything lives on app.mobileb.net.

Transport

• Streamable HTTP, stateless. Exactly one JSON-RPC 2.0 object per POST; a top-level array is not a batch and is rejected.
• GET and DELETE answer 405. No Mcp-Session-Id is ever minted, so any request may be the first.
• Protocol versions: 2026-07-28, and for compatibility 2025-11-25, 2025-06-18 and 2025-03-26.
• On 2026-07-28 there is no handshake: use server/discover or call a tool, put the version in params._meta, and send matching MCP-Protocol-Version and Mcp-Method headers, plus Mcp-Name on tools/call. initialize, ping and prompts/list answer method-not-found on that version.
• resources/list and resources/templates/list are advertised and empty.

OAuth behavior

• PKCE with S256 is required. plain is refused.
• Redirect URIs match exactly. Errors raised before the URI is validated are shown to the person rather than redirected, so this cannot be used as an open redirector.
• Resource indicators (RFC 8707) are validated. A token requested for another audience is refused with invalid_target. On every MCP request the token must still name the canonical https://app.mobileb.net/mcp resource, and its client id must still match the live grant.
• Authorization codes are single use and live two minutes. Replaying one revokes the grant it minted, on the assumption that a copy is loose.
• Refresh tokens rotate. Presenting a retired one ends the whole family.
• Registration is open but bounded: 10 new clients per address per hour, with the origin recorded on every row. An exact repeat of identical metadata returns the existing client and costs nothing against the cap, which is what connectors do when each new person connects.
• Client ID Metadata Documents are not advertised. Use RFC 7591 registration; do not infer CIMD support from the modern protocol version.
• There is no client-management or secret-rotation endpoint. A client that loses its secret registers again.

Scopes and step-up

The resource advertises mcp:read, mcp:send and mcp:share. The authorization server also advertises offline_access, because clients may ask for refresh tokens.

• An unauthenticated call answers 401 with WWW-Authenticate naming the protected-resource metadata and offering mcp:read, mcp:send and mcp:share. The consent screen still starts on read only, with sharing off.
• Calling a tool that needs a permission the token lacks answers 403 with Bearer error="insufficient_scope", the exact required scope set and the metadata URL, so a conforming client can ask the owner for more.
• Registration eligibility is not consent. Discovery and default registration include mcp:share so a client can satisfy a step-up challenge; the consent screen's sharing choice is still off every time it loads and still requires send permission.
• Manual tokens have a fixed grant: they see only the tools that grant allows, with no step-up.

Tokens and lifetimes

• Connector access tokens last one hour. Refresh tokens rotate, with a 30-day idle limit and a 60-day absolute limit; past either, the person connects again.
• The grant behind a token is re-resolved on every call, so revoking in the app takes effect on the next request rather than at expiry.
• Personal tokens start with mba_, are shown once, are stored as a hash, and expire in 24 hours, 7 days, 30 days or never, as the owner chose.
• Consent grants expire in 30, 90 or 365 days, or when revoked.
• A connector grant counts against the same token allowance as a hand-made token.

Limits and errors

• 240 requests per minute per address, independent of the per-token budgets below. Over either, the answer is 429.
• Per token, per minute: 240 standard, 12 media, 6 video, 12 transcription, 2 sync.
• Body limit 6 MiB on /mcp. Inline media in send_media is capped at 4 MiB and must be canonical padded base64; returned images are capped at 8 MiB, audio at 16 MiB, video clips at 8 MiB.
• The bytes decide the type, not the filename. Executables and archives are refused.
• A missing object and one outside the grant answer the same way, so the endpoint is never an existence oracle.

Tool contracts

Every tool has a typed input schema and a typed output schema, and results carry structuredContent. Both are published: /ai/tools.json carries the whole set with the scopes each tool needs, its budget class and its retry hint; the tool reference is the same data for people. Do not retry a tool automatically unless its idempotent field is true.

All 42 tools are live on 0.9.0-beta.1. The agent manual is written to be handed to the agent itself, and is served verbatim at /llms-full.txt.