Endpoints
MCP server
On the same domain as the API, with the mcp prefix:
| Environment | MCP server URL | REST API |
|---|---|---|
| Production | https://mcp.finance.kobana.com.br | https://api.finance.kobana.com.br/v1 |
| Sandbox | https://mcp.finance.sandbox.kobana.com.br | https://api.finance.sandbox.kobana.com.br/v1 |
The server URL is the host root — that is the address you paste into an MCP client, nothing else: the workspace is picked on every call, through the tools' workspace_id argument. ?workspace_id=<uuid> is still accepted, but it only sets a default workspace for the connection — see Authentication → The workspace. The root is also the OAuth resource identifier, which is why it carries no path.
Routes served
| Method | Path | Purpose |
|---|---|---|
POST | / | One JSON-RPC message per request. The whole tool surface. |
GET | /.well-known/oauth-protected-resource | Protected-resource metadata (RFC 9728). Public, unauthenticated. |
GET | / | 405 — this server is stateless and opens no server→client stream. |
DELETE | / | 204 — there is no session to end. |
Each environment has its own database and authorization server: a token issued in sandbox does not work in production. Start in sandbox: the destructive tools delete bills and send payments to the bank for real.
:::info A separate host, on purpose The MCP server has its own host instead of a path on the API or app host. The OAuth discovery document has to live at the host root, and no dashboard cookie is ever sent to this origin — which rules out, by construction, a whole class of confused deputy problems. :::
Local development
In development the endpoint answers at /mcp on the app host (http://localhost:3029/mcp), and the discovery document at /.well-known/oauth-protected-resource. In sandbox and production, outside mcp.finance.*, the endpoint answers 404.