Endpoints

MCP server

Environment	URL
Production	https://mcp.kadu.ia.br
Staging	https://mcp.staging.kadu.ia.br

The server URL is the host root — that whole address is what you paste into an MCP client. It is also the OAuth resource identifier (the token's audience), which is why it carries no path.

Routes served

Method	Path	What for
POST	/	One JSON-RPC message per request. The whole surface of tools, resources and prompts.
GET	/.well-known/oauth-protected-resource	Protected resource metadata (RFC 9728). Public, no authentication.
GET	/	405 (after authentication) — this server is stateless and opens no server→client stream.
DELETE	/	204 (after authentication) — there is no session to end.

On the MCP host, any other path answers 404 in JSON, with any method:

{ "error": { "code": "NOT_FOUND", "message": "Not found." } }

Docs, console and API

	URL
Documentation	https://docs.kadu.ia.br
Agent Console (production)	https://app.kadu.ia.br — where the approval link points
Agent Console (staging)	https://app.staging.kadu.ia.br
v1 API (production)	https://api.kadu.ia.br/v1
v1 API (staging)	https://api.staging.kadu.ia.br/v1

tip

Each environment has its own audience: a token issued for the staging MCP is not valid on production, and vice versa. Do not reuse a token across environments.

:::info A separate host, on purpose The MCP server has its own host instead of a path on the API or console host. There are three reasons: the OAuth discovery document has to live at the host root; no console session cookie is ever sent to this origin, which removes a whole class of confused deputy problems by construction; and the MCP token has its own audience, which cannot be mistaken for the API's. :::

Local development

In development the endpoint answers at /mcp on the app host (http://localhost:3030/mcp), and the discovery document at /.well-known/oauth-protected-resource. Outside development, /mcp answers only when the request comes through the MCP host's edge; through the console or API host, the answer is 404.