The HTTP API and MCP endpoint share the same account, wallet, connected-app readiness and catalog contracts. MCP is a transport for the nine control tools; it is not a second catalog or credential plane.

## HTTP API

The API is rooted at `https://api.scrollport.com/v1`. The nine control operations map to these resource routes:

| Control operation | HTTP request |
| --- | --- |
| `search_tools` | `GET /v1/tools/search` |
| `inspect_tool` | `GET /v1/tools/:id` |
| `run_tool` | `POST /v1/runs` |
| `get_run` | `GET /v1/runs/:id` |
| `list_apps` | `GET /v1/apps` |
| `get_wallet` | `GET /v1/wallet` |

Setup uses `/auth/device` and `/auth/token`. Public catalog search is available without an account, while agent discovery uses the authenticated control-tool surface. OAuth permission identifiers are independent of control-tool names and remain unchanged.

## MCP over Streamable HTTP

The canonical MCP endpoint is `https://mcp.scrollport.com/`. The established `https://api.scrollport.com/mcp` route remains a non-redirecting compatibility alias. The server implements `initialize`, `ping`, `tools/list` and `tools/call`; it does not advertise resources, prompts or sampling.

Supported connector clients use OAuth discovery, authorisation code with S256 PKCE, short-lived access tokens and a stable refresh credential. Existing programmatic clients may continue to send an `sp_live_…` bearer key. Never put either credential form in committed configuration.

`tools/list` returns exactly `search_tools`, `inspect_tool`, `run_tool`, `get_run`, `list_apps`, `get_wallet`, `get_files`, `upload_file` and `delete_file`. `tools/call` wraps a successful or teaching-error result so the model sees the `hint` instead of losing it as a transport exception.

## Read an existing run

The MCP server does not issue a session id. `run_tool` starts a run; `get_run` reads its status and result using the stored `run_id` through any instance. Reading a run does not require an idempotency key and cannot start or charge another run.

The HTTP read returns the current state immediately. MCP `get_run` can wait for up to 120 seconds using `wait_seconds`, then returns the latest state with the same `run_id`.

## Protocol errors and tool errors

Malformed JSON-RPC requests are protocol errors. A well-formed tool call with an invalid input, missing connection, insufficient balance or failed provider execution is a tool result with `isError: true` and a teaching payload. Read [errors](https://scrollport.com/docs/reference/errors) before deciding whether to retry.

For client-specific setup, use the published guides for [Claude](https://scrollport.com/docs/mcp/claude), [ChatGPT](https://scrollport.com/docs/mcp/chatgpt), [Claude Code](https://scrollport.com/docs/mcp/claude-code), [Codex](https://scrollport.com/docs/mcp/codex), [Cursor](https://scrollport.com/docs/mcp/cursor), [OpenClaw](https://scrollport.com/docs/mcp/openclaw), [Hermes](https://scrollport.com/docs/mcp/hermes) and [Grok](https://scrollport.com/docs/mcp/grok). Use this transport reference for another compatible client only after confirming that it supports remote Streamable HTTP with OAuth.