> ## Documentation Index
> Fetch the complete documentation index at: https://docs.elanotes.com/llms.txt
> Use this file to discover all available pages before exploring further.

# MCP cloud

> Streamable HTTP MCP on the same host and auth as /v1.

Cloud MCP is `GET` / `POST` / `DELETE /mcp` on the API host. Same auth
plugin as `/v1`. Same shared tool registry as [MCP local](/mcp-local)
(`search_notes`, `grep_notes`, `read_note`, `list_notes`, `list_tags`,
…). Writes go through HTTP `/v1`, not MCP tools.

Production: `https://api.elanotes.com/mcp`. Local:
`http://127.0.0.1:4000/mcp`.

## Auth challenge

Unauthenticated `/mcp` returns `401` with RFC 6750
`WWW-Authenticate: Bearer realm="elanotes"` and, when an issuer is
configured, `resource_metadata` pointing at
`/.well-known/oauth-protected-resource` (RFC 9728).

```http theme={null}
WWW-Authenticate: Bearer realm="elanotes", error="invalid_token", error_description="…", resource_metadata="https://api.elanotes.com/.well-known/oauth-protected-resource"
```

Open locally when no auth is configured (same as `/v1`). The local
metadata URL is `http://127.0.0.1:4000/.well-known/oauth-protected-resource`.
Production requires a bearer. See [API overview](/api/overview).

## Cursor / Claude Code

```json theme={null}
{
  "mcpServers": {
    "elanotes-cloud": {
      "url": "https://api.elanotes.com/mcp",
      "headers": { "Authorization": "Bearer YOUR_TOKEN" }
    }
  }
}
```

Local: `"url": "http://127.0.0.1:4000/mcp"`. Leave the header off when
the API is in the open-local path.

## Rate limits

`/mcp` uses the **read** abuse ceiling (`RATE_LIMIT_READ_PER_MINUTE`,
default 600). Reads are never metered for cost. A `429` includes
`Retry-After` and `reason: RATE_LIMITED`.