The MCP server

Unitley runs one remote MCP server. Any MCP client that can send an Authorization header can connect to it, including Claude Code, Claude Desktop, Cursor and Hermes Agent. It offers 20 tools, Unitley's knowledge notes as resources, and 3 prompts.

Server URLCopy Anchor Link

The URL is the same for everyone. Your access token decides whose account the tools act on.

• Server name: unitley
• Server version: 0.1.0

To set up a specific client, see Connect to Claude or Any MCP client.

AuthenticationCopy Anchor Link

Send an access token from the Connect page with every request:

Authorization: Bearer YOUR_UNITLEY_TOKEN

A missing token, or one not shaped like a Unitley token, gets HTTP 401 with a Bearer challenge:

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer error="invalid_token", error_description="Send a Unitley access token as Authorization: Bearer unt_... (create one on the Connect page)."
Content-Type: application/json

{"error":"invalid_token","error_description":"Send a Unitley access token as Authorization: Bearer unt_... (create one on the Connect page)."}

A token that is unknown, revoked or expired gets the same 401, with the description "This access token is unknown, revoked or expired. Create a new one on the Connect page."

The token sets what the tools can do. A read-only token can read your data and run the calculators. A token with write access can also use log_bet, settle_bet and save_recommendation. See Tokens and security.

TransportCopy Anchor Link

The server speaks Streamable HTTP and is stateless. It keeps no sessions and issues no Mcp-Session-Id, and every request is served on its own.

• POST carries every JSON-RPC message. Send Content-Type: application/json, or the server answers 415.
• GET and DELETE get 405 Method not allowed. With no sessions, there is no stream to open and nothing to end.
• A POST that holds only notifications gets 202 with no body.

Protocol versionsCopy Anchor Link

Your client picks the protocol version. You do not need to set it.

CapabilitiesCopy Anchor Link

The server declares three capabilities:

• tools, with listChanged: false. The tool list does not change while you are connected. See Every tool.
• resources: the knowledge notes. There are no resource templates. See Resources.
• prompts. See Prompts.

Unitley publishes no change events. A subscriptions/listen request gets the JSON-RPC error -32601 Method not found: subscriptions/listen., and resource subscriptions are not offered.

Tools over MCPCopy Anchor Link

tools/list returns every tool, including the write tools, whatever your token's scope. Each entry has a title, a description, a JSON Schema for its input, and annotations: readOnlyHint, destructiveHint, idempotentHint and openWorldHint. The hints describe the tool. The scope check is what enforces it.

A successful tools/call returns:

• one text item that holds the result as JSON, and
• structuredContent with the same object, when the result is a JSON object.

A tool that fails returns a result with isError: true, not a protocol error. The text item holds the message, and structuredContent.error holds the same code, message and issues the REST API sends, plus retryAfterSeconds when you should wait. Errors lists every code.

A read-only token that calls a write tool gets an isError result with the code insufficient_scope.

Checks on every requestCopy Anchor Link

Each request meets these checks in this order:

1. Host. The request must reach the console's own hostname. Any other host gets 403.
2. Origin. A browser may call only from the console itself. A request from another site gets 403. Desktop apps, command-line tools and servers send no Origin header and pass.
3. Per-address budget. 300 a minute from one IP address, counted before the token is checked. A refusal is 429 with Retry-After. See Rate limits.
4. Token shape. A missing or malformed token gets 401.
5. Body. A JSON body over 256 KB gets 413, and one that is not valid JSON gets 400.
6. Token owner. An unknown, revoked or expired token gets 401.
7. The call. Tools run as you, so they can only see and change your own data. Each tool call counts against your per-token and per-user budgets.

The server does not send CORS headers. Every response carries Cache-Control: no-store.

Errors before the tools runCopy Anchor Link

These come back as JSON-RPC error objects with id: null, except the 401s, which use the Bearer challenge above.

Your client's nameCopy Anchor Link

Your client names itself in clientInfo: in initialize under the 2025-era versions, or with each request under 2026-07-28. Unitley keeps that name with the token and shows it on the Connect page.

Bets and picks saved over MCP carry a client label: the clientInfo name when the request includes it, otherwise the client's User-Agent. The label is for your records only. It never changes what a request may do.

Server instructionsCopy Anchor Link

The server sends these rules to every client as its MCP instructions. The REST API returns the same text from GET /api/v1/tools.

NextCopy Anchor Link

• Every tool, with each tool's inputs and outputs
• Resources and Prompts
• Rate limits
• The REST API, for the same tools without MCP