The HTTP API and MCP endpoint share the same account, wallet, connected-app readiness and catalog contracts. MCP is a transport for the nine control tools; it is not a second catalog or credential plane.
HTTP API
The API is rooted at https://api.scrollport.com/v1. The nine control operations map to these resource routes:
| Control operation | HTTP request |
|---|---|
search_tools | GET /v1/tools/search |
inspect_tool | GET /v1/tools/:id |
run_tool | POST /v1/runs |
get_run | GET /v1/runs/:id |
list_apps | GET /v1/apps |
get_wallet | GET /v1/wallet |
get_files | GET /v1/files |
upload_file | POST /v1/files/uploads |
delete_file | DELETE /v1/files/:id |
Setup uses POST https://api.scrollport.com/v1/auth/device and POST https://api.scrollport.com/v1/auth/token. Agents with authenticated HTTPS and persistent secure storage can use this route without MCP; see direct API setup. Public catalog search is available without an account, while agent discovery uses the authenticated control-tool surface. OAuth permission identifiers are independent of control-tool names and remain unchanged.
MCP over Streamable HTTP
The canonical MCP endpoint is https://mcp.scrollport.com/. The established https://api.scrollport.com/mcp route remains a non-redirecting compatibility alias. The server implements initialize, ping, tools/list and tools/call; it does not advertise resources, prompts or sampling.
Supported connector clients use OAuth discovery, authorisation code with S256 PKCE, short-lived access tokens and a stable refresh credential. Existing programmatic clients may continue to send an sp_live_… bearer key. Never put either credential form in committed configuration.
tools/list returns exactly search_tools, inspect_tool, run_tool, get_run, list_apps, get_wallet, get_files, upload_file and delete_file. tools/call wraps a successful or teaching-error result so the model sees the hint instead of losing it as a transport exception.
Read an existing run
The MCP server does not issue a session id. run_tool starts a run; get_run reads its status and result using the stored run_id through any instance. Reading a run does not require an idempotency key and cannot start or charge another run.
The HTTP read returns the current state immediately. MCP get_run can wait for up to 120 seconds using wait_seconds, then returns the latest state with the same run_id.
Protocol errors and tool errors
Malformed JSON-RPC requests are protocol errors. A well-formed tool call with an invalid input, missing connection, insufficient balance or failed provider execution is a tool result with isError: true and a teaching payload. Read errors before deciding whether to retry.
For client-specific setup, use the published guides for Claude, ChatGPT, Claude Code, Codex, Cursor, OpenClaw, Hermes and Grok. For an unlisted client, assess its actual capabilities using /start. Remote MCP requires Streamable HTTP with OAuth; direct HTTP requires authenticated HTTPS and persistent secure storage instead.