---
title: "Depot mcp"
description: "Every mcp operation in the Depot API, with parameters, responses and code samples in six languages."
url: "https://support.outpostplatform.com/api/generated/depot/mcp/"
product: "depot"
type: "reference"
status: "reviewed"
last_reviewed: 2026-11-06
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/api/generated/depot/mcp.mdx"
license: "CC BY 4.0"
---

# Depot mcp

Mounts POST/GET/DELETE /mcp on one face's mux (MCP_CONTRACTS.md 9).

This page is generated from the Depot route table. Every operation carries the permission it needs and the anchor an agent can link to.

### GET `/mcp` {#depot.mcp.mcp.get}

**GET /mcp**

#### Responses

| Status | Body | Description |
| --- | --- | --- |
| `200` | None | Success. The body shape was not resolved; see x-outpost-unresolved. |

#### Request samples

```bash
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/mcp' \
  -H 'Authorization: Bearer <oauth-bearer>'
```

```powershell
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'Authorization' = 'Bearer <oauth-bearer>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/mcp' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10
```

```python
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/mcp"
headers = {
    "Authorization": "Bearer <oauth-bearer>",
}

response = requests.get(url, headers=headers, timeout=30)
response.raise_for_status()
print(response.json())
```

```go
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
	"fmt"
	"io"
	"log"
	"net/http"
)

func main() {
	req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/mcp", nil)
	if err != nil {
		log.Fatal(err)
	}

	req.Header.Set("Authorization", "Bearer <oauth-bearer>")

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		log.Fatal(err)
	}
	defer resp.Body.Close()

	out, err := io.ReadAll(resp.Body)
	if err != nil {
		log.Fatal(err)
	}
	fmt.Println(resp.Status, string(out))
}
```

```ts
// This operation is idempotent. Repeating it does not repeat its effect.

const url = "https://depot.example.com/mcp";

const response = await fetch(url, {
	method: "GET",
	headers: {
		"Authorization": "Bearer <oauth-bearer>",
	},
});

if (!response.ok) {
	throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);
```

```csharp
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/mcp");
request.Headers.TryAddWithoutValidation("Authorization", "Bearer <oauth-bearer>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());
```

### POST `/mcp` {#depot.mcp.mcp.post}

**POST /mcp**

#### Responses

| Status | Body | Description |
| --- | --- | --- |
| `200` | None | Success. The body shape was not resolved; see x-outpost-unresolved. |

#### Request samples

```bash
curl -X POST 'https://depot.example.com/mcp' \
  -H 'Authorization: Bearer <oauth-bearer>'
```

```powershell
$headers = @{
    'Authorization' = 'Bearer <oauth-bearer>'
}

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/mcp' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10
```

```python
import requests

url = "https://depot.example.com/mcp"
headers = {
    "Authorization": "Bearer <oauth-bearer>",
}

response = requests.post(url, headers=headers, timeout=30)
response.raise_for_status()
print(response.json())
```

```go
package main

import (
	"fmt"
	"io"
	"log"
	"net/http"
)

func main() {
	req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/mcp", nil)
	if err != nil {
		log.Fatal(err)
	}

	req.Header.Set("Authorization", "Bearer <oauth-bearer>")

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		log.Fatal(err)
	}
	defer resp.Body.Close()

	out, err := io.ReadAll(resp.Body)
	if err != nil {
		log.Fatal(err)
	}
	fmt.Println(resp.Status, string(out))
}
```

```ts
const url = "https://depot.example.com/mcp";

const response = await fetch(url, {
	method: "POST",
	headers: {
		"Authorization": "Bearer <oauth-bearer>",
	},
});

if (!response.ok) {
	throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);
```

```csharp
using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/mcp");
request.Headers.TryAddWithoutValidation("Authorization", "Bearer <oauth-bearer>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());
```

### DELETE `/mcp` {#depot.mcp.mcp}

**DELETE /mcp**

#### Responses

| Status | Body | Description |
| --- | --- | --- |
| `200` | None | Success. The body shape was not resolved; see x-outpost-unresolved. |

#### Request samples

```bash
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X DELETE 'https://depot.example.com/mcp' \
  -H 'Authorization: Bearer <oauth-bearer>'
```

```powershell
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'Authorization' = 'Bearer <oauth-bearer>'
}

$response = Invoke-RestMethod `
    -Method Delete `
    -Uri 'https://depot.example.com/mcp' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10
```

```python
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/mcp"
headers = {
    "Authorization": "Bearer <oauth-bearer>",
}

response = requests.delete(url, headers=headers, timeout=30)
response.raise_for_status()
print(response.json())
```

```go
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
	"fmt"
	"io"
	"log"
	"net/http"
)

func main() {
	req, err := http.NewRequest(http.MethodDelete, "https://depot.example.com/mcp", nil)
	if err != nil {
		log.Fatal(err)
	}

	req.Header.Set("Authorization", "Bearer <oauth-bearer>")

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		log.Fatal(err)
	}
	defer resp.Body.Close()

	out, err := io.ReadAll(resp.Body)
	if err != nil {
		log.Fatal(err)
	}
	fmt.Println(resp.Status, string(out))
}
```

```ts
// This operation is idempotent. Repeating it does not repeat its effect.

const url = "https://depot.example.com/mcp";

const response = await fetch(url, {
	method: "DELETE",
	headers: {
		"Authorization": "Bearer <oauth-bearer>",
	},
});

if (!response.ok) {
	throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);
```

```csharp
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Delete, "https://depot.example.com/mcp");
request.Headers.TryAddWithoutValidation("Authorization", "Bearer <oauth-bearer>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());
```

### OPTIONS `/mcp` {#depot.mcp.preflight}

**mcpPreflight answers a browser client's CORS preflight, which carries no credentials (the bearer branch lets it through).**

Any origin, never credentials; 404 off the canonical Host like the route itself.

#### Responses

| Status | Body | Description |
| --- | --- | --- |
| `204` | None | Success, with no body. |
| `404` | `application/problem+json`, ProblemDetails | No resource matches. |

#### Request samples

```bash
# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X OPTIONS 'https://depot.example.com/mcp' \
  -H 'Accept: application/json'
```

```powershell
# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'Accept' = 'application/json'
}

$response = Invoke-RestMethod `
    -Method Options `
    -Uri 'https://depot.example.com/mcp' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10
```

```python
# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/mcp"
headers = {
    "Accept": "application/json",
}

response = requests.options(url, headers=headers, timeout=30)
response.raise_for_status()
print(response.json())
```

```go
// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
	"fmt"
	"io"
	"log"
	"net/http"
)

func main() {
	req, err := http.NewRequest(http.MethodOptions, "https://depot.example.com/mcp", nil)
	if err != nil {
		log.Fatal(err)
	}

	req.Header.Set("Accept", "application/json")

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		log.Fatal(err)
	}
	defer resp.Body.Close()

	out, err := io.ReadAll(resp.Body)
	if err != nil {
		log.Fatal(err)
	}
	fmt.Println(resp.Status, string(out))
}
```

```ts
// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.

const url = "https://depot.example.com/mcp";

const response = await fetch(url, {
	method: "OPTIONS",
	headers: {
		"Accept": "application/json",
	},
});

if (!response.ok) {
	throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);
```

```csharp
// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Options, "https://depot.example.com/mcp");
request.Headers.TryAddWithoutValidation("Accept", "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());
```