MCP Tools And Resources · Developers Hub

MyronCMS exposes a Streamable HTTP MCP surface for AI clients. The canonical local path is:

POST /mcp

POST /api/mcp/v1/messages is also wired as a legacy alias. The route accepts JSON-RPC 2.0 requests and delegates method handling to MyronMcpServer.

Human Path

A developer or operator uses this page to understand what an MCP client can discover and call. The source authority is the running install:

initialize confirms protocol version and advertised capabilities.
tools/list returns callable tools for the current authorization context.
resources/list returns readable documentation and state resources.
tools/call invokes a registered action through the dispatcher.
resources/read reads a named resource.

Do not use docs as a copied MCP catalog. Tool availability changes with registered actions, exposeToMcp, and caller scopes.

AI Path

An installed MCP client should start with:

initialize with Authorization: Bearer <token>
read Mcp-Session-Id response header
initialized with Authorization + Mcp-Session-Id
tools/list with Authorization + Mcp-Session-Id
resources/list with Authorization + Mcp-Session-Id

Then it should read the resource or call the tool that matches the task. If a tool is missing, the client should check scope and exposure instead of inventing a direct call.

An AI coding agent working locally can inspect app/system/mcp/Server.php and app/api/routes/mcp-v1.php to verify current resource URIs and method handling.

MCP Methods

Method	Current behavior
`initialize`	Requires bearer auth, returns protocol version, tools capability, resources capability, server info, and emits `Mcp-Session-Id` as an HTTP response header.
`initialized` / `notifications/initialized`	Requires bearer auth plus `Mcp-Session-Id`; marks the lifecycle session ready for discovery.
`ping`	Returns an empty success result.
`tools/list`	Requires an initialized session; lists exposed, policy-allowed, scope-allowed action tools plus the current creative-library tool when design scope allows it.
`tools/call`	Requires an initialized session; calls a named tool; action-backed tools delegate to `MyronActionDispatcher`.
`resources/list`	Requires an initialized session; lists current MCP resources permitted for the caller.
`resources/read`	Requires an initialized session; reads a permitted MCP resource and returns text content.
`notifications/cancelled`	Accepted as a no-op for current short-running behavior.

The initialize response advertises tools and resources. It does not advertise prompts, logging, or experimental custom capabilities.

Current Resources

resources/list currently advertises resources according to caller scope:

URI	Minimum MCP resource scope	MIME type	Use
`mcp://myroncms/system/manifest`	authenticated session	`application/json`	Scope-filtered exposed action catalog with metadata.
`mcp://myroncms/system/snapshot`	`administration.read`	`application/json`	Live state composed from snapshot-eligible read actions.
`mcp://myroncms/system/compatibility/configured`	`administration.read`	`application/json`	Live install compatibility document.
`mcp://myroncms/system/compatibility/default`	authenticated session	`application/json`	Site-type default compatibility document.
`mcp://creative-component-sdk`	`design.read`	`text/markdown`	Creative Component SDK guide with live install context.
`mcp://myroncms/design/jsonm-interchange`	`design.read`	`text/markdown`	JSONM design-system interchange guide with live examples.

For default compatibility by site type, resources/read also accepts a site-type query shape such as:

mcp://myroncms/system/compatibility/default?siteType=BIZ

Tool Discovery

Action-backed tool names are derived from action metadata:

{domain}_{resource}_{verb}

The MCP server normalizes names to lowercase snake_case for tools/list. tools/call also supports some transitional aliases for older clients, but clients should use the exact names from tools/list.

tools/list filters actions by:

exposeToMcp: true,
caller scope,
policy-hidden trust-gate and identity/admin classes,
registered action availability in the running install.

See MCP Tool Exposure for the policy around hidden actions.

Scopes

This reference page has no single required runtime scope. Each tool has the scope declared by its underlying MyronActionMetadata.requiredScope. MCP discovery omits tools the caller cannot normally invoke.

Resource access is authenticated and scope-filtered. Some resources are documentation-like, but MCP still treats them as protected because they may include live install context or examples.

Artifacts

Primary source contracts:

app/system/mcp/Server.php
app/api/routes/mcp-v1.php
app/system/api/Action.php
app/system/api/ActionDispatcher.php

Runtime entrypoints:

/mcp
/api/mcp/v1/messages
MCP tools/list
MCP tools/call
MCP resources/list
MCP resources/read

Error Mapping

tools/call uses the action dispatcher for action-backed tools. Important mappings:

Dispatcher outcome	MCP result
Missing or invalid auth	JSON-RPC auth error path.
Missing session / pre-initialized session	JSON-RPC session error path.
`scope_insufficient`	JSON-RPC error with authorization-denied data.
`rate_limited`	JSON-RPC error with retry metadata.
Action-declared failure	Tool result with `isError: true`.
Unknown tool name	Method-not-found style error.
Successful action	Tool result with JSON text content and audit metadata.

Safety Boundary

MCP does not bypass auth, scopes, audit, rate limits, or trust-grant controls. It is a protocol binding over the action catalog.

MCP also does not broadcast install-specific catalogs just because a client can reach the endpoint. The client must hold a valid bearer token, complete initialize, preserve the returned Mcp-Session-Id, and send initialized before discovery.

Do not document missing tools as bugs until you check scope, action load state, and exposeToMcp. Do not tell an MCP client to create or expand its own integration to solve missing access.

Verification

For an MCP client:

initialize with bearer auth returns tools/resources capabilities and Mcp-Session-Id
initialized with Mcp-Session-Id completes lifecycle
tools/list returns only tools visible to the caller
resources/list includes only resource URIs visible to the caller
resources/read returns the expected MIME type for a listed resource
tools/call shares dispatcher behavior with the direct API

For documentation review, verify current resource URIs against app/system/mcp/Server.php.

Failure Modes

Failure	Likely cause	Safe response
Tool absent from `tools/list`	Caller lacks scope, action is hidden, or action is not registered.	Check manifest, action metadata, and caller scope.
Resource URI returns not found	URI is misspelled, resource registration changed, or caller lacks resource scope.	Re-read `resources/list` with the same caller.
`MCP_SESSION_REQUIRED` / `MCP_SESSION_NOT_INITIALIZED`	Client skipped lifecycle or lost the session header.	Run initialize, preserve `Mcp-Session-Id`, then send initialized.
`tools/call` cannot find a listed-looking name	Client inferred a name instead of using discovery.	Use the exact name from `tools/list`.
`MCP_RATE_LIMITED`	AI bearer caller exceeded its current budget.	Back off and retry after the window.
Live state resource is treated as static docs	Client confused resources with source documentation.	Re-read resource before planning state-sensitive work.