MCP hujjatlari — Transport, OAuth, xatolar

Umumiy

Endpoint va transport

Xususiyat	Qiymat
MCP endpoint	`/mcp/mcp.php`
Transport	Streamable HTTP (faqat POST)
Xabar formati	JSON-RPC 2.0 (single va batch)
Protocol versiyalari	`2025-06-18`, `2025-03-26`, `2024-11-05`
Session	`Mcp-Session-Id` initialize'da beriladi, stateless server
GET/DELETE	GET → 405 (SSE qo'llab-quvvatlanmaydi), DELETE → 405
CORS	Headerlar: `Authorization`, `Content-Type`, `MCP-Protocol-Version`, `MCP-Session-Id`
Cheklov	120 `tools/call` / daqiqa / token

Auth

OAuth 2.1 discovery manzillari

Manzil	Standart	Vazifa
`/.well-known/oauth-protected-resource`	RFC 9728	Resurs metama'lumoti + `authorization_servers`
`/.well-known/oauth-authorization-server`	RFC 8414	Authorization server metama'lumoti
`/mcp/register`	RFC 7591	Dynamic Client Registration (201 + client_id)
`/mcp/authorize`	RFC 6749	Login + consent, PKCE S256 majburiy
`/mcp/token`	RFC 6749	`authorization_code` + `refresh_token` (rotating)
`/mcp/revoke`	RFC 7009	Tokenni bekor qilish

# 401 javobda resource_metadata bo'ladi (RFC 9728)
HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer realm="aura-retail-mcp",
  resource_metadata="/.well-known/oauth-protected-resource",
  error="invalid_token"

# Statik API kaliti (skriptlar uchun)
Authorization: Bearer mcp_YOUR_TOKEN

Xato kodlari

JSON-RPC xatolar

Kod	Nomi	Qachon
`-32700`	Parse error	JSON yaroqsiz
`-32600`	Invalid Request	`jsonrpc` yoki `method` yo'q
`-32601`	Method not found	Noma'lum method
`-32602`	Invalid params	Noto'g'ri argumentlar yoki vosita nomi
`-32603`	Internal error	Server ichki xatosi
`-32001`	Unauthorized	Token yo'q/yaroqsiz (HTTP 401)

Vosita xatosi — protokol xatosi emas. Vosita ichida xato bo'lsa, javob result.isError=true bilan qaytadi, error blok bilan emas.

Misollar

curl bilan sinash

# 1) initialize
curl -s -X POST /mcp/mcp.php \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer mcp_YOUR_TOKEN" \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"curl","version":"1.0"}}}'

# 2) notifications/initialized → 202 (bo'sh javob)
curl -s -o /dev/null -w "%{http_code}\n" -X POST /mcp/mcp.php \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer mcp_YOUR_TOKEN" \
  -d '{"jsonrpc":"2.0","method":"notifications/initialized"}'

# 3) tools/list
curl -s -X POST /mcp/mcp.php \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer mcp_YOUR_TOKEN" \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/list"}'

# 4) discovery
curl -s /.well-known/oauth-protected-resource
curl -s /.well-known/oauth-authorization-server

MCP Inspector: npx @modelcontextprotocol/inspector → Transport Streamable HTTP → URL manzil → Connect.

Versiyalash

Versiya siyosati

Server versiyasi

/mcp/status.json dagi version maydoni (masalan 0.0.1). O'zgarishlar qo'shimcha xususiyat sifatida.

Protocol versiyasi

initialize'da mijozniki qaytariladi; qo'llab-quvvatlanmasa server 2025-06-18 taklif qiladi.

Vositalar

Vositalar qo'shilishi mumkin (backwards-compatible). Har doim tools/list dan tekshiring.