Endpoints
MCP server
| Environment | URL |
|---|---|
| Production | https://mcp.dashboards.kobana.com.br |
| Sandbox | https://mcp.dashboards.sandbox.kobana.com.br |
The server URL is the root of the host — that whole address is what you paste into an MCP client. It is also the OAuth resource identifier, which is why it carries no path.
Routes served
| Method | Path | Purpose |
|---|---|---|
POST | / | One JSON-RPC message per request. The entire tool surface. |
GET | /.well-known/oauth-protected-resource | Protected-resource metadata (RFC 9728). Public, unauthenticated. |
GET | / | 405 — this server is stateless and opens no server→client stream. |
DELETE | / | 204 — there are no sessions to terminate. |
Documentation and API
| URL | |
|---|---|
| Documentation | https://docs.dashboards.kobana.com.br |
| REST API (production) | https://api.dashboards.kobana.com.br |
| REST API (sandbox) | https://api.dashboards.sandbox.kobana.com.br |
Each environment has its own database and its own authorization server. A token issued in sandbox is not valid in production — start in sandbox.
:::info Separate host, on purpose The MCP server has its own host rather than a path on the API or app host. Three reasons: the OAuth discovery document has to live at the root of the host; no dashboard cookie is ever sent to this origin, which removes a whole class of confused-deputy problems by construction; and the API host has an edge policy designed for server-to-server integrations, not for a consumer app. :::
Local development
In development the endpoint answers at /mcp on the app host (http://localhost:3001/mcp), and the discovery document at /.well-known/oauth-protected-resource. Outside development the host allow-list hides the endpoint (404) outside mcp.dashboards.*.
On the MCP host, any path that is neither the endpoint nor the discovery document answers a JSON 404, whatever the method:
{ "error": { "code": "NOT_FOUND", "message": "Not found." } }