MCP cloud - Ela

Cloud MCP is GET / POST / DELETE /mcp on the API host. Same auth plugin as /v1. Same shared tool registry as MCP local (search_notes, grep_notes, read_note, list_notes, list_tags, …). Writes go through HTTP /v1, not MCP tools. Production: https://api.elanotes.com/mcp. Local: http://127.0.0.1:4000/mcp.

Auth challenge

Unauthenticated /mcp returns 401 with RFC 6750 WWW-Authenticate: Bearer realm="elanotes" and, when an issuer is configured, resource_metadata pointing at /.well-known/oauth-protected-resource (RFC 9728).

WWW-Authenticate: Bearer realm="elanotes", error="invalid_token", error_description="…", resource_metadata="https://api.elanotes.com/.well-known/oauth-protected-resource"

Open locally when no auth is configured (same as /v1). The local metadata URL is http://127.0.0.1:4000/.well-known/oauth-protected-resource. Production requires a bearer. See API overview.

Cursor / Claude Code

{
  "mcpServers": {
    "elanotes-cloud": {
      "url": "https://api.elanotes.com/mcp",
      "headers": { "Authorization": "Bearer YOUR_TOKEN" }
    }
  }
}

Local: "url": "http://127.0.0.1:4000/mcp". Leave the header off when the API is in the open-local path.

Rate limits

/mcp uses the read abuse ceiling (RATE_LIMIT_READ_PER_MINUTE, default 600). Reads are never metered for cost. A 429 includes Retry-After and reason: RATE_LIMITED.