MCP Server

​

Transport surfaces

1. Stdio server (npm run mcp:dev / npm run mcp)
2. Streamable HTTP transport (POST|GET|DELETE /mcp)

​

Live endpoint

​

Session behavior

• initialize creates a session
• follow-up requests include mcp-session-id
• DELETE /mcp closes session state

​

Authentication (HTTP transport)

• DZAP_MCP_HTTP_TOKEN, when set, every /mcp request must include Authorization: Bearer <token> (compared in constant time).
• DZAP_MCP_ALLOWED_ORIGINS, optional comma-separated Origin allowlist that blocks drive-by browser callers.

​

JSON-RPC error handling

{
  "jsonrpc": "2.0",
  "id": "req-2",
  "error": {
    "code": -32602,
    "message": "Invalid params",
    "data": {
      "tool": "PerformZapTool",
      "field": "amount",
      "expected": "string"
    }
  }
}

• -32600 invalid request
• -32601 method not found
• -32602 invalid params
• -32603 internal error

​

Tool annotations

{
  "name": "BalanceTool",
  "description": "Fetch wallet balances",
  "annotations": {
    "readOnlyHint": true
  }
}

​

MCP resources and prompts

• dzap://tools/catalog
• dzap://prompts/system
• dzap://docs/urls

• wallet-overview
• tool-execution-plan

​

Remote config example

{
  "mcpServers": {
    "DZapAI": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://nlp-ai-439689868940.europe-north1.run.app/mcp"]
    }
  }
}

​

Local run commands

npm run mcp:dev

npm run build
npm run mcp

​

Library exports

• createDzapMcpServer(...)
• startDzapMcpServer(...)