From e56f15700c285e188ccedf6fc98fc3bb9fa7bec8 Mon Sep 17 00:00:00 2001 From: FilipBl4gojevic <84703395+FilipBl4gojevic@users.noreply.github.com> Date: Tue, 4 Aug 2026 21:17:22 +0200 Subject: [PATCH] docs(readme): hosted instances are open access and serve /mcp (#19) The README described both hosted instances as requiring a bearer token, and /mcp as self-hosted-only pending a future deploy. Both statements are stale: the hosted fleet now admits anonymous callers with per-IP rate limiting, and /mcp is live on mainnet and testnet. - Endpoint table and the primary connection example now use /mcp. - Connection examples drop the Authorization header for the hosted URLs. - /sse stays documented as the legacy transport, also tokenless for hosted. - MCP_AUTH_TOKENS remains documented for self-hosted deployments; that feature is unchanged, it is simply unset on the hosted fleet. Custody language is deliberately untouched. Keyless (no server-side signing keys) and authless (no bearer token) are separate properties and the text keeps them separate. Co-authored-by: Claude Opus 5 --- README.md | 48 +++++++++++++++++++----------------------------- 1 file changed, 19 insertions(+), 29 deletions(-) diff --git a/README.md b/README.md index 0ee5354..0df36f6 100644 --- a/README.md +++ b/README.md @@ -12,51 +12,41 @@ Hosted instances run on both networks, exposing all 24 tools: | Network | Endpoint | |---------|----------| -| Mainnet | `https://mcp.vector.mainnet.apexfusion.org/sse` | -| Testnet | `https://mcp.vector.testnet.apexfusion.org/sse` | +| Mainnet | `https://mcp.vector.mainnet.apexfusion.org/mcp` | +| Testnet | `https://mcp.vector.testnet.apexfusion.org/mcp` | > **Deployment status: both networks are current.** Both hosted instances run today's > completed migration: testnet since the 2026-07-31 morning merges (auto-deployed from > `main`), mainnet since a deliberate cutover deploy the same day (see > [docs/architecture/non-custodial-split.md](docs/architecture/non-custodial-split.md), section -> 11, "Rollout", for the full history). **Both hosted instances currently require a bearer -> token from the operators to connect** - that is an access control, not a custody one: -> neither instance accepts a mnemonic from any caller, token or not. Open public access -> (per-IP rate limiting, no token required) is a planned follow-up, not yet enabled on the -> hosted instances - the per-IP rate-limiting code ships in this release; only the ops action -> of unsetting `MCP_AUTH_TOKENS` remains, coordinated separately after this deploys. Self-host -> this release for tokenless access today. +> 11, "Rollout", for the full history). **Both hosted instances are open access - no bearer +> token is required to connect.** Callers are admitted anonymously with per-IP rate limiting. +> That is an access-control property, and it is separate from custody: neither instance +> accepts a mnemonic from any caller, with or without a token. Self-hosted deployments can +> still gate access with `MCP_AUTH_TOKENS` - see [Configuration](#configuration). -> **Transport: the hosted URLs above still answer on `/sse` only.** This codebase now serves -> a modern Streamable HTTP endpoint, `/mcp`, alongside `/sse` + `/messages` - the legacy SSE -> transport, deprecated by the MCP spec (2026-07-28 revision), retained for compatibility. -> `/mcp` becomes each hosted instance's primary endpoint once this release merges and deploys -> - testnet automatically on the next push to `main`, mainnet on the next deliberate cutover -> dispatch, the same split the migration above went through. Until then, -> `https://mcp.vector.mainnet.apexfusion.org/mcp` and its testnet twin are not reachable; -> self-host this release (below) to use `/mcp` today. +> **Transport: both hosted instances serve `/mcp`, the modern Streamable HTTP endpoint.** +> It is the recommended transport and the endpoint listed in the table above. The legacy SSE +> pair (`/sse` + `/messages`) remains available on both hosted instances for clients that need +> it, deprecated by the MCP spec (2026-07-28 revision) and retained for compatibility. -Connect from Claude Code in one command. Both hosted instances require a bearer token from the -operators (contact the Apex Fusion team for one). +Connect from Claude Code in one command. No token needed for the hosted instances. -Modern transport (Streamable HTTP) - works today against a self-hosted instance (below); against -the hosted URLs above it goes live once each instance deploys this release (see the transport -note above): +Modern transport (Streamable HTTP) - recommended: ```bash -claude mcp add --transport http vector-mcp /mcp \ - --header "Authorization: Bearer " +claude mcp add --transport http vector-mcp https://mcp.vector.mainnet.apexfusion.org/mcp ``` -Legacy SSE transport - what the hosted URLs above actually answer on today: +Legacy SSE transport - still answered by both hosted instances: ```bash -claude mcp add --transport sse vector-mcp https://mcp.vector.mainnet.apexfusion.org/sse \ - --header "Authorization: Bearer " +claude mcp add --transport sse vector-mcp https://mcp.vector.mainnet.apexfusion.org/sse ``` -Self-hosting (below) needs no token, gives every caller open access to your own instance, and -serves `/mcp` today. +Swap in the testnet host for either command to connect to testnet instead. Self-hosting (below) +serves both transports too, and gives every caller open access to your own instance unless you +set `MCP_AUTH_TOKENS`. > **Security notice: the non-custodial migration is complete, in this codebase and on both > hosted instances, as of the 2026-07-31 cutover deploy.** No tool in this repository accepts a