Sonket MCP

Sonket runs a tools-only MCP server, so an editor or a terminal can work a project without opening the dashboard. Every tool it offers has a page of its own here, as the server answers it. It is read-only against every platform it watches. No tool posts, likes, follows or messages, here or anywhere else.

{
  "mcpServers": {
    "sonket": {
      "type": "http",
      "url": "https://sonket.com/api/mcp",
      "headers": { "Authorization": "Bearer YOUR_KEY" }
    }
  }
}

Make a key at /mcp, read scope or write scope. A read key is never shown a write tool.

Add to CursorInstall in VS Code

Swap YOUR_KEY for a key from /mcp.

Transport

  • POST /api/mcp and nothing else. GET and DELETE answer 405 with Allow: POST.
  • Stateless JSON-RPC 2.0: one request in, one response out. A notification is answered 202 with no body.
  • Four methods: initialize, tools/list, tools/call and ping. Batched requests are refused, since MCP dropped them in the 2025-06-18 revision.
  • Protocol versions spoken: 2025-06-18, 2025-03-26, 2024-11-05. Anything else negotiates to the newest.

Auth

  • Authorization: Bearer snk_sk_…, a key made at /mcp. There is no OAuth and no cookie.
  • A key carries read scope or write scope, and the scope is fixed when the key is made.
  • A missing, unknown or revoked key is 401 with WWW-Authenticate: Bearer realm="sonket" and a JSON-RPC error body whose message names /mcp.
  • A read key is never shown a write tool by tools/list, and is refused it if it calls one anyway.

Results

  • A tool answers with one plain sentence, then the same facts as JSON in the same text block, and again in structuredContent for clients that read it.
  • A refusal is isError: true carrying the dashboard's own sentence for that refusal, never an invented one. A JSON-RPC error code is kept for what the transport got wrong: bad JSON, an unknown method.

Constraints

  • Read-only against every platform. No tool posts, likes, follows or messages, here or anywhere else.
  • A tool that changes a row needs a write key, and is refused for the read-only demo account.
  • Nothing here reaches admin, the system keys or your own provider keys.
  • A tool that spends money or an AI action says so in its own description.
  • Email, password, sign-in links and account deletion are dashboard-only, at /settings?tab=signin; a key can never take over the account.
  • Your own platform and model keys are set at /byok and never over MCP: a key in a chat client is a key in a model's context.
  • Nothing that reads X runs over MCP yet: a profile refresh, a study scan and re-reading one blip's counts are dashboard actions with a price on the button. Starting a watch is here, and the polls after it are what it costs.

The same registry as one file for a model to read: /llms.txt and /llms-full.txt.