Any other client

Any client that supports remote MCP servers over Streamable HTTP can use IndexZero. You need exactly one fact, the endpoint:

https://app.indexzero.site/mcp

If the client supports OAuth for remote servers, that is all: it discovers the authorization server from the endpoint, registers itself, and opens a browser for approval. If it does not, create an API key and send it as an x-api-key header.

The common configuration shape

Most clients, including Hermes and OpenClaw, accept the same JSON shape Cursor and Claude Code use:

{
  "mcpServers": {
    "indexzero": {
      "url": "https://app.indexzero.site/mcp"
    }
  }
}

With an API key:

{
  "mcpServers": {
    "indexzero": {
      "url": "https://app.indexzero.site/mcp",
      "headers": {
        "x-api-key": "iz_your_key_here"
      }
    }
  }
}

Some clients call the transport "type": "http" or "transport": "streamable-http"; use whichever your client documents. Do not choose SSE: the server rejects the legacy SSE transport.

Calling the endpoint directly

The endpoint is plain JSON-RPC 2.0 over HTTP. This lists the tools with an API key:

curl -X POST https://app.indexzero.site/mcp \
  -H "x-api-key: iz_your_key_here" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "MCP-Protocol-Version: 2026-07-28" \
  -H "Mcp-Method: tools/list" \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "tools/list",
    "params": {
      "_meta": {
        "io.modelcontextprotocol/protocolVersion": "2026-07-28",
        "io.modelcontextprotocol/clientCapabilities": {}
      }
    }
  }'

The full header set matters. The current protocol revision requires MCP-Protocol-Version, the Mcp-Method mirror of the body (and Mcp-Name for tools/call), and the _meta envelope; a shorter request fails with a -32020 error. An MCP SDK sends these for you, which is the recommended route for anything beyond a smoke test.

A tool call looks like this:

curl -X POST https://app.indexzero.site/mcp \
  -H "x-api-key: iz_your_key_here" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "MCP-Protocol-Version: 2026-07-28" \
  -H "Mcp-Method: tools/call" \
  -H "Mcp-Name: whoami" \
  -d '{
    "jsonrpc": "2.0",
    "id": 2,
    "method": "tools/call",
    "params": {
      "name": "whoami",
      "arguments": {},
      "_meta": {
        "io.modelcontextprotocol/protocolVersion": "2026-07-28",
        "io.modelcontextprotocol/clientCapabilities": {}
      }
    }
  }'

Function calling without MCP

If your stack uses an LLM provider's native function calling rather than MCP, fetch the catalog:

GET https://app.indexzero.site/api/mcp/catalog

It is unauthenticated and returns every tool with a name, description, and JSON Schema for its arguments, in the shape function-calling APIs expect. Hand the definitions to your model, and when it picks one, execute it with a tools/call request as above. See Machine-readable reference.

CORS

The endpoint answers preflight requests and allows any origin, with the headers Content-Type, Accept, Authorization, mcp-session-id, MCP-Protocol-Version, Mcp-Method, and Mcp-Name, and exposes mcp-session-id. Browser-based clients therefore work, but keep API keys out of browser code: use OAuth there.