MCP API

MCP endpoints exposed by the Devotel CPaaS API Base path: /api/v1/public/mcp/.well-known/mcp.json Endpoint count: 1

title: “MCP discovery manifest — worked sample” description: “The full .well-known server.json manifest an MCP client reads before it connects, field by field.”

Hosted MCP server discovery manifest (public)

Orbit runs a hosted remote MCP server at POST /api/v1/mcp (Streamable-HTTP JSON-RPC) that lets an MCP-aware agent host or aggregator drive Orbit’s CPaaS capabilities — messaging, voice, contacts, campaigns, analytics — without running a local process. But callers need to know the server exists before they hold an Orbit API key. This public, unauthenticated endpoint fills that gap: it returns a standard MCP Registry server.json-shaped manifest that aggregators, crawlers, and MCP clients can read to auto-discover and auto-configure the server. The same manifest is also served from two self-serve copies — https://orbit.devotel.io/.well-known/mcp.json for self-hosted discovery and apps/mcp-server/server.json in the repo — kept in lockstep so every discovery path sees the same payload.

Response example

200

{
  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
  "name": "io.devotel/orbit-cpaas",
  "description": "Orbit's hosted remote MCP server: drive a caller's own Orbit CPaaS tenant (SMS, WhatsApp, voice, contacts, campaigns, analytics) over Streamable-HTTP JSON-RPC — no local process.",
  "version": "1.0.0",
  "protocolVersion": "2025-06-18",
  "remotes": [
    {
      "type": "streamable-http",
      "url": "https://api.orbit.devotel.io/api/v1/mcp"
    }
  ],
  "documentation": "https://docs.orbit.devotel.io/guides/mcp-claude-cursor",
  "auth": {
    "type": "api-key",
    "headers": ["Authorization: Bearer <key>", "X-API-Key: <key>"],
    "docs": "https://docs.orbit.devotel.io/authentication",
    "note": "Bring your own Orbit API key (dv_live_sk_* / dv_test_sk_* for a zero-charge sandbox trial). Every tool call runs with that key's own scopes and tenant — there is no separate MCP-specific credential."
  }
}

Field	Description
`name`	The MCP Registry namespace for Orbit’s hosted server. Aggregators key on this to deduplicate listings.
`version`	The hosted server version. Tracks the tool catalog; bumping it signals that the available tool set changed.
`protocolVersion`	The MCP protocol revision the server speaks. Callers should negotiate to the highest version they support up to this one.
`remotes[0].url`	The Streamable-HTTP endpoint for actual JSON-RPC calls (`POST /api/v1/mcp`). This is the URL an aggregator passes to its MCP client transport.
`auth`	Hints for clients that need to configure authentication. Orbit tool calls use the same Orbit API keys as every other REST route — no separate MCP credential.
`documentation`	Link to the MCP setup guide on the Orbit docs site.

Caching

The response carries a Cache-Control: public, max-age=300, s-maxage=300, stale-while-revalidate=600 header. Manifest contents change rarely (only when the hosted server version is bumped), so aggregators can cache the response for up to five minutes and serve stale content for ten minutes while revalidating in the background. Treat the version field as eventually consistent — a newly deployed tool catalog may take up to the cache window to surface.

No authentication required

This endpoint is registered before API-key authentication in the app’s middleware chain — it is genuinely unauthenticated by design, not just documented that way. Aggregators, registry crawlers, and MCP client transports should call it without an API key. The auto-generated request samples below show an X-API-Key header for consistency with the rest of the API reference, but the route ignores it — the key is only needed at the actual JSON-RPC endpoint (POST /api/v1/mcp), never at the discovery manifest.

Next steps

Make a tool call: POST /api/v1/mcp — the Streamable-HTTP JSON-RPC endpoint (see the MCP server guide for a full walkthrough).
Self-hosted twin files: https://orbit.devotel.io/.well-known/mcp.json and the repo file apps/mcp-server/server.json carry the same manifest for local-process and self-hosted discovery paths.

Hosted MCP server discovery manifest (public)

GET /api/v1/public/mcp/.well-known/mcp.json

Unauthenticated, server.json-shaped manifest describing Orbit’s hosted remote MCP server (POST /api/v1/mcp, Streamable-HTTP). Lets aggregators and MCP-aware agent hosts discover and auto-configure the server without a human handing out the URL.

cURL

curl -X GET "https://api.orbit.devotel.io/api/v1/public/mcp/.well-known/mcp.json" \
  -H "X-API-Key: dv_live_sk_your_key_here" 

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/public/mcp/.well-known/mcp.json', {
  method: 'GET',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
  },
})
console.log(await res.json())

Python

import os, requests

headers = {"X-API-Key": os.environ["ORBIT_API_KEY"]}
r = requests.get("https://api.orbit.devotel.io/api/v1/public/mcp/.well-known/mcp.json", headers=headers)
print(r.json())

package main

import (
	"bytes"
	"net/http"
	"os"
)

func main() {
	req, _ := http.NewRequest("GET", "https://api.orbit.devotel.io/api/v1/public/mcp/.well-known/mcp.json", nil)
	req.Header.Set("X-API-Key", os.Getenv("ORBIT_API_KEY"))

	http.DefaultClient.Do(req)
}

Ruby

require 'net/http'
require 'json'

uri = URI('https://api.orbit.devotel.io/api/v1/public/mcp/.well-known/mcp.json')
req = Net::HTTP::Get.new(uri)
req['X-API-Key'] = ENV['ORBIT_API_KEY']


res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
puts res.body

PHP

<?php
$ch = curl_init('https://api.orbit.devotel.io/api/v1/public/mcp/.well-known/mcp.json');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'GET');
curl_setopt($ch, CURLOPT_HTTPHEADER, [
  'X-API-Key: ' . getenv('ORBIT_API_KEY'),

]);

echo curl_exec($ch);

{}

API Reference

All Endpoints

MCP API

MCP API

title: “MCP discovery manifest — worked sample” description: “The full .well-known server.json manifest an MCP client reads before it connects, field by field.”

Hosted MCP server discovery manifest (public)

Response example

Caching

No authentication required

Next steps

Hosted MCP server discovery manifest (public)

​MCP API

​title: “MCP discovery manifest — worked sample” description: “The full .well-known server.json manifest an MCP client reads before it connects, field by field.”

​Hosted MCP server discovery manifest (public)

​Response example

​Caching

​No authentication required

​Next steps

​Hosted MCP server discovery manifest (public)

MCP API

title: “MCP discovery manifest — worked sample” description: “The full .well-known server.json manifest an MCP client reads before it connects, field by field.”

Hosted MCP server discovery manifest (public)

Response example

Caching

No authentication required

Next steps

Hosted MCP server discovery manifest (public)