> ## Documentation Index
> Fetch the complete documentation index at: https://docs.secapi.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Hosted MCP Workflows

> Connect an MCP-aware client to SEC API, verify the deployed contract, and retain provenance.

Hosted MCP is an authenticated JSON-RPC endpoint. Start with live discovery,
not a copied client configuration.

## 1. Read deployed metadata

```bash theme={null}
curl --fail-with-body "https://api.secapi.ai/mcp" | jq .
```

The discovery response exposes `protocolVersion`, `capabilities`, and
`distribution`. The distribution payload includes the streamable HTTP transport
and current `x-api-key` and client-install hints.

## 2. Configure and prove a research path

Use the distribution transport URL and its `x-api-key`/client hints to configure
your client. Keep credentials in the client's secret or environment facility.
A successful `GET /mcp` proves discovery is available, not that an authenticated
tool call will succeed.

Ask the client to resolve an issuer, retrieve a filing, and extract a section.
A completed research result should retain issuer identity, accession number,
filing date, filing URL, section key, and request ID where returned. Tool output
is retrieved evidence, not an investment recommendation or legal conclusion.

## Errors and production use

`GET /mcp` is discovery; `POST /mcp` is authenticated JSON-RPC. HTTP-level gates
can fail before protocol dispatch. Preserve JSON-RPC error data and request/trace
identifiers, use bounded retries only for transient failures, and log tool
arguments with source identifiers.

## Next steps

* [Evaluate hosted MCP](/evaluate/sec-filings-mcp-server)
* [MCP installation](/mcp-install)
* [Filing retrieval](/api-reference/filings)