Other MCP clients

What any MCP client needs to use GoBanana, the endpoint facts, and a bridge for clients that only run local stdio servers.

Any client that speaks the Model Context Protocol over HTTP with OAuth can use GoBanana.

MCP server address

https://gobanana.fun/api/mcp

Endpoint facts


URL	`https://gobanana.fun/api/mcp`
Transport	Streamable HTTP, stateless. `GET`, `POST` and `DELETE` on the same path
Auth	OAuth 2.1 bearer token, required on every request. Sign in runs through WorkOS AuthKit (authorization code with PKCE `S256`)
Client registration	Both Client ID Metadata Documents (`client_id_metadata_document_supported: true`) and Dynamic Client Registration (a `registration_endpoint`). No pre-registered client ID needed
Discovery	A request without a token gets `401` with `WWW-Authenticate: Bearer ... resource_metadata="https://gobanana.fun/.well-known/oauth-protected-resource"` (RFC 9728). The metadata is also served at `/.well-known/oauth-protected-resource/api/mcp`
Resource	`https://gobanana.fun/api/mcp`. Tokens must carry it as their audience
Tools	17 for the agent, plus 2 app-only tools the canvas view uses (`save_canvas_state`, `load_canvas_state`). Do not call those two from an agent
UI	One MCP Apps resource, `ui://banana/canvas` (mime `text/html;profile=mcp-app`), opened by `open_canvas`

Only /api/mcp is the MCP endpoint. Other /api/... paths answer 404 to MCP clients.

What your client must support

Remote HTTP servers (streamable HTTP). Old SSE-only clients will not connect.
OAuth for MCP: reading the 401 challenge, protected resource metadata, and a browser sign in. If your client only takes a fixed header or API key, it cannot sign in; there are no GoBanana API keys.
Optional, MCP Apps: to show the board inline. Without it, the reply carries a web link.

Stdio only clients

Some clients can only start local servers over stdio. Bridge them with mcp-remote, which runs locally, handles the OAuth sign in in your browser and forwards to GoBanana. You need Node.js 18 or newer.

{
  "mcpServers": {
    "gobanana": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://gobanana.fun/api/mcp"]
    }
  }
}

The first start opens a browser to sign in. mcp-remote keeps credentials in ~/.mcp-auth (change it with MCP_REMOTE_CONFIG_DIR). Delete that folder to sign out. Its default transport, http-first, is right for GoBanana.

Check the endpoint yourself

# An unsigned call: expect 401 and a WWW-Authenticate header with resource_metadata
curl -i -X POST https://gobanana.fun/api/mcp   -H "content-type: application/json" -H "accept: application/json, text/event-stream"   -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

# Protected resource metadata: names the authorization server
curl https://gobanana.fun/.well-known/oauth-protected-resource

# Or with the MCP Inspector (opens a browser to sign in when run in a terminal)
npx -y @modelcontextprotocol/inspector --cli https://gobanana.fun/api/mcp --method tools/list

What was verified

On 2026-10-12: the unsigned curl above returned 401 with WWW-Authenticate: Bearer error="invalid_token", error_description="No authorization provided", resource_metadata="https://gobanana.fun/.well-known/oauth-protected-resource". Both metadata URLs returned the resource …/api/mcp and the AuthKit authorization server, whose /.well-known/oauth-authorization-server lists the authorize, token and registration endpoints, PKCE S256 and CIMD support. MCP Inspector 2.10.1 in non-interactive mode stopped with auth_required, as expected. The mcp-remote config follows its README; it was not run here.

Writing your own client

Use an MCP SDK (TypeScript, Python and others) with its OAuth helper, point it at the URL, and list tools. Each tool’s JSON schema is strict. Bad input never throws: it returns a plain message such as “brief must be 1 to 500 characters.” Read content[0].text. See the tool reference.