Answers
What is the correct MCP server URL, /mcp or /api/mcp?
Short answer
Use https://bananabanana.pro/api/mcp. That is the JSON-RPC endpoint. The bare /mcp path is the human documentation page, and posting JSON-RPC to it historically returned HTML — the single most common misconfiguration. Requests to /mcp are now rewritten to the canonical route, but configure clients with /api/mcp so nothing depends on that.
- Endpoint
- https://bananabanana.pro/api/mcp
- Transport
- Streamable HTTP — POST JSON-RPC, stateless
- Auth
- OAuth 2.1, or Authorization: Bearer bb_live_…
- /mcp
- Documentation page for humans; POSTs are rewritten to the canonical route
- Discovery
- /.well-known/oauth-protected-resource
- GET / DELETE
- 405 — there is no session or SSE stream
Facts on this page were checked against the live platform on .
Why do two paths exist at all?
/mcp is a documentation page — the endpoint, the tool reference, per-client configuration snippets, prices. It is a normal web page, so a browser gets HTML, which is exactly right for a human and exactly wrong for an agent.
/api/mcp is the machine surface. It speaks JSON-RPC over Streamable HTTP, stateless: every call is a POST, there is no session header to carry and no stream to hold open.
The failure mode when they are confused is unmistakable — the client reports a JSON parse error on something that starts with <!doctype html>. Requests posted to /mcp are rewritten to the canonical route now, and the challenge header points back at the path you actually typed, but the URL to put in a config file is /api/mcp.
What does a healthy connection look like?
An initialize call succeeds without credentials and returns the server info. tools/list succeeds too and returns ten tools, five of them free. Only tools/call demands a token, answering 401 with a WWW-Authenticate header when one is missing — that 401 is what starts the OAuth flow in connector-style clients.
If initialize itself fails, the problem is the URL or the transport, not authentication. If everything lists but calls come back 401 after signing in, check the header shape and that the token was issued for this resource.
Which URL goes into which client?
Connector-style clients — Claude on the web and desktop — take the server URL in their UI and complete OAuth themselves; no key is pasted anywhere. Config-file clients — Claude Code, Cursor, VS Code, Windsurf, Codex, Cline — take the same URL plus an Authorization: Bearer bb_live_… header in the server entry.
Registry entries point at /api/mcp as well. An early registry release listed the bare /mcp path by mistake; that version was deprecated and every listing since names the canonical route.
Where this is documented
Longer reads on the same thing
More on this question
Is there an SSE endpoint?
No. The transport is stateless Streamable HTTP — a POST in, a single JSON response out. GET and DELETE answer 405.
Do I need a session id header?
No. The server is stateless and does not issue Mcp-Session-Id; each request carries its own credentials.
Is there a separate endpoint for paying per call?
Yes — /api/x402, deliberately kept apart. MCP must answer 401 to trigger OAuth, x402 must answer 402 for the same unpaid request; the two contracts cannot share a URL.
How do I check the server from a terminal?
POST an initialize request with curl. A JSON-RPC response means the URL is right; an HTML document means you hit the documentation page.
Questions next door
Why does an MCP server list tools fine but return 401 when I call one?
That is lazy authorisation, and it is deliberate. Catalogue methods — initialize, ping, tools/list — answer without credentials so directories can read the tool list. Only a paid action, tools/call, requires a token, and it answers 401 with a WWW-Authenticate header. That 401 is exactly what triggers the OAuth sign-in flow in Claude; a 200 there would leave the header ignored and the client stuck.
Read the answerCan an AI agent generate images without an account or API key?
Yes, over x402. An agent holding a wallet posts a request, receives HTTP 402 with the exact price for those arguments, pays in USDC on Base and repeats the request with a payment header. No sign-up, no API key, no prepaid balance. Images and speech settle only after the file exists, so a failure costs nothing.
Read the answerDo I get my money back when an AI generation fails?
Yes, automatically and in full. The charge happens when a generation starts and is reversed the moment it is marked failed — upstream errors, capacity errors and content-filter rejections all refund without a support ticket. A batch that is only partly rejected is refunded proportionally. There is nothing to claim and no waiting period.
Read the answerTry it on your own prompt
New accounts start with $0.20 of balance — no card, nothing expires.