Owner-route runtime reference

Owner-scoped endpoints speak JSON-RPC 2.0 over HTTP POST.

Route: /mcp/u/:owner
Auth: OAuth-first discovery challenge and client-managed access tokens.
Core methods: initialize, tools/list, tools/call

Discovery challenge check

curl -i -sS "https://mcp.loadoutz.io/mcp/u/<owner-id>"

Expected: 401 with WWW-Authenticate containing resource_metadata=.

initialize (debug)

curl -sS -X POST "https://mcp.loadoutz.io/mcp/u/<owner-id>" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <oauth-access-token>" \
  --data '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"client","version":"1.0.0"}}}'

tools/list (debug)

curl -sS -X POST "https://mcp.loadoutz.io/mcp/u/<owner-id>" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <oauth-access-token>" \
  --data '{"jsonrpc":"2.0","id":2,"method":"tools/list","params":{}}'

Behavior notes

Run initialize before tool operations.
Re-run tools/list after loadout/auth/consent changes.
Tool allowlist is enforced by active loadout scope at gateway time.
Connected clients can receive notifications/tools/list_changed on capability updates.
Do not use GET for tool methods; runtime contract is POST JSON-RPC.

Need help next?

Quickstart Agent setup Troubleshooting Resources