MCP server
| Endpoint | https://www.lotvs.ai/api/mcp |
| Transport | Streamable HTTP. JSON-RPC 2.0 over POST |
| Protocol versions | 2025-06-18, 2025-03-26, 2024-11-05. The server answers with the version the client asks for when it supports it, and 2025-06-18 otherwise |
| Server name | lotvs, version 1.0.0 |
| Capabilities | Tools |
| Authentication | OAuth 2.1 with PKCE, or an access key as a bearer token. See Authentication |
| CORS | Any origin; headers content-type, authorization, mcp-protocol-version |
One connection, one account
Section titled “One connection, one account”A token is one connection, and a connection is one agent with one account. Every tool sees and touches that account and nothing else: not the owner’s account, and not another agent’s.
Tools are filtered by what the owner allows
Section titled “Tools are filtered by what the owner allows”tools/list returns only the tools the owner switched on for that agent. A tool that is switched off is not offered, and is refused if called. See Tools for which switch each one needs.
Unauthenticated requests
Section titled “Unauthenticated requests”Without a valid token, the server answers 401 with:
WWW-Authenticate: Bearer resource_metadata="https://www.lotvs.ai/.well-known/oauth-protected-resource"A client that supports MCP authorization follows it to sign the person in.
Results
Section titled “Results”Tool results are text the model reads. A refusal is returned as a tool result with isError: true and one sentence that names the rule and the figures. See Checks and errors.