MCP
clepit's MCP surface lets agents read and write workspaces and pages. Bearer only: any request carrying an Origin header is refused.
| Host | Serves |
|---|---|
| https://api.clepit.com |
mcp
POST/mcphttps://api.clepit.com
Invoke an MCP method
JSON-RPC 2.0 over HTTP. Every request needs Mcp-Protocol-Version: 2026-07-28.
Auth bearerAuth
Parameters
| Name | In | Type | Description |
|---|---|---|---|
| Mcp-Protocol-Version required | header | string | Must be 2026-07-28 |
Body
JSON
{
"id": "integer",
"jsonrpc": "2.0",
"method": "server/discover | ping | tools/list | tools/call",
"params?": "object"
}Responses
200 A JSON-RPC 2.0 response object.
Try it
curl -X POST "https://api.clepit.com/mcp" \
-H "Authorization: Bearer $BEARER_AUTH" \
-H "Content-Type: application/json" \
-d '{"id":0,"jsonrpc":"2.0","method":"server/discover","params":{}}'const response = await fetch('https://api.clepit.com/mcp', {
method: 'POST',
headers: {
Authorization: `Bearer ${bearerAuth}`,
'Content-Type': 'application/json',
},
body: JSON.stringify({
"id": 0,
"jsonrpc": "2.0",
"method": "server/discover",
"params": {}
}),
});
const data = await response.json();final response = await http.post(
Uri.parse('https://api.clepit.com/mcp'),
headers: {
'Authorization': 'Bearer $bearerAuth',
'Content-Type': 'application/json',
},
body: jsonEncode({"id":0,"jsonrpc":"2.0","method":"server/discover","params":{}}),
);response = requests.post(
"https://api.clepit.com/mcp",
headers={"Authorization": f"Bearer {bearer_auth}"},
json={"id":0,"jsonrpc":"2.0","method":"server/discover","params":{}},
)Protocol revision
Revision 2026-07-28. No session, no initialize handshake. A mismatched Mcp-Protocol-Version is rejected with JSON-RPC error -32020.
Browsers are not a supported client
The allowed-origins list is deliberately empty, so any request carrying an
Origin header is refused. This is a machine-to-machine surface; widening it is a security decision, not a configuration tweak.Discovery
GET /.well-known/oauth-protected-resource stays reachable with no token at all, it is how an unauthenticated client learns where to authenticate.
Tools
| Tool | Does |
|---|---|
| clepit.tenant.current | The caller's tenant |
| clepit.billing.status | The tenant's billing state |
| clepit.workspaces.listMine | Workspaces the caller can open |
| clepit.workspaces.create | Create a workspace |
| clepit.workspaces.update | Rename or reconfigure a workspace |
| clepit.pages.tree | A workspace's page tree |
| clepit.pages.search | Full-text search across pages |
| clepit.pages.create | Create a page |
| clepit.pages.update | Update a page's title or content |
| clepit.pages.move | Move a page in the tree |
| clepit.pages.archive | Archive a page |
Listing the tools
Bash
curl -X POST "https://api.clepit.com/mcp" \
-H "Authorization: Bearer $ACCESS_TOKEN" \
-H "Content-Type: application/json" \
-H "Mcp-Protocol-Version: 2026-07-28" \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'