# Any other client

> The generic configuration for Hermes, OpenClaw, and anything else that speaks MCP, plus calling the endpoint directly.

Source: https://docs.indexzero.site/agents/other-clients



Any client that supports remote MCP servers over **Streamable HTTP** can use IndexZero. You need exactly one fact, the endpoint:

```
https://app.indexzero.site/mcp
```

If the client supports OAuth for remote servers, that is all: it discovers the authorization server from the endpoint, registers itself, and opens a browser for approval. If it does not, create an [API key](/agents/api-keys) and send it as an `x-api-key` header.

## The common configuration shape [#the-common-configuration-shape]

Most clients, including Hermes and OpenClaw, accept the same JSON shape Cursor and Claude Code use:

```json
{
  "mcpServers": {
    "indexzero": {
      "url": "https://app.indexzero.site/mcp"
    }
  }
}
```

With an API key:

```json
{
  "mcpServers": {
    "indexzero": {
      "url": "https://app.indexzero.site/mcp",
      "headers": {
        "x-api-key": "iz_your_key_here"
      }
    }
  }
}
```

Some clients call the transport `"type": "http"` or `"transport": "streamable-http"`; use whichever your client documents. Do not choose SSE: the server rejects the legacy SSE transport.

## Calling the endpoint directly [#calling-the-endpoint-directly]

The endpoint is plain JSON-RPC 2.0 over HTTP. This lists the tools with an API key:

```bash
curl -X POST https://app.indexzero.site/mcp \
  -H "x-api-key: iz_your_key_here" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "MCP-Protocol-Version: 2026-07-28" \
  -H "Mcp-Method: tools/list" \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "tools/list",
    "params": {
      "_meta": {
        "io.modelcontextprotocol/protocolVersion": "2026-07-28",
        "io.modelcontextprotocol/clientCapabilities": {}
      }
    }
  }'
```

The full header set matters. The current protocol revision requires `MCP-Protocol-Version`, the `Mcp-Method` mirror of the body (and `Mcp-Name` for `tools/call`), and the `_meta` envelope; a shorter request fails with a `-32020` error. An MCP SDK sends these for you, which is the recommended route for anything beyond a smoke test.

A tool call looks like this:

```bash
curl -X POST https://app.indexzero.site/mcp \
  -H "x-api-key: iz_your_key_here" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "MCP-Protocol-Version: 2026-07-28" \
  -H "Mcp-Method: tools/call" \
  -H "Mcp-Name: whoami" \
  -d '{
    "jsonrpc": "2.0",
    "id": 2,
    "method": "tools/call",
    "params": {
      "name": "whoami",
      "arguments": {},
      "_meta": {
        "io.modelcontextprotocol/protocolVersion": "2026-07-28",
        "io.modelcontextprotocol/clientCapabilities": {}
      }
    }
  }'
```

## Function calling without MCP [#function-calling-without-mcp]

If your stack uses an LLM provider's native function calling rather than MCP, fetch the catalog:

```
GET https://app.indexzero.site/api/mcp/catalog
```

It is unauthenticated and returns every tool with a name, description, and JSON Schema for its arguments, in the shape function-calling APIs expect. Hand the definitions to your model, and when it picks one, execute it with a `tools/call` request as above. See [Machine-readable reference](/reference/machine-readable).

## CORS [#cors]

The endpoint answers preflight requests and allows any origin, with the headers `Content-Type`, `Accept`, `Authorization`, `mcp-session-id`, `MCP-Protocol-Version`, `Mcp-Method`, and `Mcp-Name`, and exposes `mcp-session-id`. Browser-based clients therefore work, but keep API keys out of browser code: use OAuth there.