The Vidext Operator MCP server

The Vidext Operator MCP server is a remote, authenticated MCP server speaking JSON-RPC over streamable HTTP. Client setup and the browser OAuth flow are in the quickstart; this page is the server contract.

Endpoint and identityCopy Anchor Link

https://app.vidext.com/api/mcp/operator

One URL serves every client. It exposes several typed tools, not several URLs. The server reports itself as vidext-operator (title Vidext Operator); client configurations use that name, so it does not change.

The same host serves one sibling: the public Docs MCP server at /api/mcp/docs, with no authentication. Connect it alongside Operator when you want a client that can look up how Vidext works as well as read your organization's data. There are no other MCP endpoints.

Transport detailsCopy Anchor Link

• Methods. POST, plus an OPTIONS preflight with permissive CORS for browser-based clients. The endpoint is stateless and never opens a server-initiated stream, so an authenticated GET or DELETE answers 405. Authentication runs first, so without a valid token those two answer 401.
• No sessions. The server never issues or reads MCP-Session-ID. The only response header exposed to browsers is WWW-Authenticate.
• Protocol 2026-07-28 only. Every request carries the per-request _meta envelope. A request without it, including a 2025-style initialize handshake, is answered with JSON-RPC -32022 (Unsupported protocol version) on HTTP 400, with data.supported: ["2026-07-28"]. server/discover replaces the handshake; its result carries supportedVersions.
• Method headers. Every POST carries Mcp-Method with the JSON-RPC method, plus Mcp-Name when the method names an entity (the tool name on tools/call, the URI on resources/read). A missing or mismatched header is answered with -32020 on HTTP 400.
• Responses. Exchanges answer with JSON. Keep sending Accept: application/json, text/event-stream; the transport allows a response to arrive as a stream.
• Authentication. A request without a valid token gets HTTP 401 with a WWW-Authenticate: Bearer challenge whose resource_metadata points at /.well-known/oauth-protected-resource/api/mcp/operator. The body is an OAuth error, not JSON-RPC. MCP clients follow it automatically. See Authentication.

Versioning and deprecationCopy Anchor Link

The server is versioned by MCP protocol revision, not by URL. /.well-known/mcp lists the revisions it serves in mcp.protocolVersions (today only 2026-07-28).

When a protocol revision is announced for removal, it keeps being served for at least 90 days. During that window, every exchange that names the revision in MCP-Protocol-Version and reaches the server answers with:

• Responses that never reach the server — the OPTIONS preflight, a 401 or 403, an unknown path's 404 — do not carry these headers.
• Browsers cannot read them, because only WWW-Authenticate is exposed through CORS. Server-side clients can.
• No revision is deprecated today, so no response carries them yet.
• A revision that is no longer served is answered with -32022, never silently downgraded.

These headers cover protocol revisions only; a tool carries no deprecation signal of its own. tools/list is the source of truth for the tools the server offers, so re-read it on every connection instead of caching it. The tool reference describes the current set.

ResourcesCopy Anchor Link

The server registers one MCP resource and no prompts:

The contract the server keepsCopy Anchor Link

• Identity and scope. Every call runs as the user who authorized the token, inside the organization bound to it. Only organization admins and members are admitted; the role is checked again on every call.
• Read-only. Every tool is a deterministic read that runs no model. No tool creates, builds, edits, or publishes content.
• Errors are results. A tool that fails returns a normal result with isError: true and a structured error, or, for the two knowledge tools, success: false. See Errors and limits.
• Admission control. Each call counts against a rate limit and a concurrency limit per user, organization, and tool.
• Same tools for everyone. tools/list returns the same five tools to every accepted token.

Raw JSON-RPCCopy Anchor Link

Prefer a real MCP client. For debugging with curl, get an access token first (see Authentication), then:

curl -X POST "https://app.vidext.com/api/mcp/operator" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "Authorization: Bearer <access_token>" \
  -H "Mcp-Method: tools/list" \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "tools/list",
    "params": {
      "_meta": {
        "io.modelcontextprotocol/protocolVersion": "2026-07-28",
        "io.modelcontextprotocol/clientInfo": { "name": "curl", "version": "1.0.0" },
        "io.modelcontextprotocol/clientCapabilities": {}
      }
    }
  }'

Drop the _meta envelope or the Mcp-Method header and the request is rejected, as described above.