Connection Scoped MCP Access

Scopes MCP traffic to a specific data source. This endpoint implements the MCP Streamable HTTP transport. Send any JSON-RPC 2.0 MCP request (such as initialize, tools/list, tools/call) in the request body. The server routes it within the context of the specified connection.

POST /mcp/connections/{connectionId}

cURL

initialize

curl --request POST \ --url https://mcp.cloud.cdata.com/mcp/connections/{connectionId} \ --header 'Authorization: Bearer <token>' \ --header 'Content-Type: application/json' \ --data ' { "jsonrpc": "2.0", "method": "initialize", "params": { "protocolVersion": "2024-11-05", "capabilities": {}, "clientInfo": { "name": "my-client", "version": "1.0.0" } }, "id": 1 } '

200

{
  "id": "<string>",
  "result": {},
  "error": {
    "code": 123,
    "message": "<string>",
    "data": "<unknown>"
  }
}

Omit id to send a notification. (No response expected. The server returns 202 No Content).

Use the ?tools= and ?ops= query parameters to narrow the list of returned tools.

• ?tools= — comma-separated list of tool types (universal, sql, source). Omit to return all types.
• ?ops= — comma-separated list of operation names (for example, execute_sql, get_tables). Omit to return tools for all operations.

Both parameters are narrowing-only: they can remove tools from the response but cannot enable tools that the server has already disabled for the connection. If a parameter is repeated in the request, only the first value is used. An empty string or an unrecognized value returns HTTP 400 with JSON-RPC code -32602 (ToolFilterParseError).

Authorizations

Authorization · string · header · required

JWT token authentication. Include the token in the Authorization header as 'Bearer '.

Path Parameters

connectionId · string<uuid> · required

The unique identifier of the connection to scope this request to.

Query Parameters

tools · enum<string>[]

Comma-separated list of tool types to include in tools/list responses. Omitting returns all types. If repeated, only the first occurrence is used. An empty string or unrecognized value returns HTTP 400. Narrowing-only: cannot enable tools the server has already disabled.

Available options: universal, sql, source

ops · enum<string>[]

Comma-separated list of operation base names to include in tools/list responses. Omitting returns tools for all operations. If repeated, only the first occurrence is used. An empty string or unrecognized value returns HTTP 400. Narrowing-only: cannot enable tools the server has already disabled.

Available options: get_catalogs, get_schemas, get_tables, get_columns, get_procedures, get_procedure_parameters, get_instructions, execute_sql, execute_select, execute_insert, execute_update, execute_procedure

Body

application/json

jsonrpc · enum<string> · required

JSON-RPC protocol version. Must be "2.0".

Available options: 2.0

method · string · required

MCP method name (for example, initialize, tools/list, tools/call).

params · object

Method-specific parameters. May be omitted for parameterless methods.

id · string integer

Request identifier echoed in the response. Use a string or integer. Omit entirely to send a notification (no response will be returned).

Response

200

application/json

JSON-RPC response or SSE stream, depending on the request.

• application/json — returned for a single request that includes an id. The body is a JsonRpcResponse object.
• text/event-stream — returned when the server needs to stream multiple messages back (for example, long-running tool calls, server-initiated notifications). Each SSE data: line is a JSON-encoded JsonRpcResponse object. The stream closes when the server has sent all messages for the request.

jsonrpc · enum<string> · required

JSON-RPC protocol version.

Available options: 2.0

id · string integer · required

Matches the id from the request. Null if the server could not determine the request id.

result · object

Present on success; mutually exclusive with error.

error · object

Show child attributes