# Hosted MCP endpoint

Connect to `https://www.thesportsdb.com/api/mcp` using Streamable HTTP.
The public server card is at `/.well-known/mcp/server-card.json`.

This stateless PHP endpoint supports MCP versions `2025-03-26` and
`2025-06-18`, initialization, ping, notifications, tool discovery and tool calls.
It returns JSON responses to POST requests; the optional standalone SSE stream
is not offered (GET returns 405). No Node process or session storage is needed.
The generated Node packages remain available for existing local clients.

Send `Content-Type: application/json` and
`Accept: application/json, text/event-stream`. After initialization, send the
negotiated `MCP-Protocol-Version` header. Browser requests with an Origin header
are restricted to the site's two HTTPS origins; native MCP clients normally
omit Origin.

Discovery is public. Configure your MCP client to send your own premium
`X_API_KEY` header for tool calls. The endpoint forwards that header to the
existing v2 API, which retains its paid-key checks and response caching. It
does not supply a shared key or accept keys as tool arguments. Clients must
support custom authentication headers; this endpoint does not provide OAuth.

Tools:

- `search`: `type` (league, team, player, event, venue) and `id` (search text).
- `lookup`: `type` (a supported v2 lookup category) and `id` (numeric string).
- `all`: `type` (countries, sports, leagues).

Tool results contain the existing v2 JSON in a text content block. API/auth
failures return `isError: true`; invalid tool arguments return JSON-RPC -32602.
No existing API response contracts or database configuration change.

Validation: `php tools/mcp-smoke.php` exercises the public endpoint, direct PHP
path, and server card, including authentication failure and invalid requests.
It deliberately uses no real credentials. A successful paid-key data request
must be verified with an owner's key. Run a Dedica rescan separately after
deployment; the smoke test cannot establish Dedica's score.