Protocol and client compatibility

Use this page when you select or build an MCP client.

Server definition

Property	Value
Server name	sqquid
Server title	Sqquid
Server version	0.1.0
MCP endpoint	https://mcp.sqquid.com/mcp
Protocol version	2026-07-28 only
Transport	Streamable HTTP
HTTP method	POST
Response mode	JSON
Authorization	OAuth authorization code flow with PKCE S256
Server capabilities	Tools

The server rejects legacy MCP protocol versions. It does not support the legacy HTTP and SSE transport.

The server does not provide MCP prompts, resources, or task extensions. It does not provide a subscription stream.

Read the MCP 2026-07-28 specification for the protocol definition.

Client requirements

The client must:

1. support MCP version 2026-07-28.
2. support Streamable HTTP with JSON responses.
3. send the protocol metadata for each request.
4. discover and complete OAuth authorization.
5. support tools/list and tools/call.
6. support input_required results for browser actions and approvals.

The 2026-07-28 protocol is stateless. It does not use the older initialize handshake or an Mcp-Session-Id header.

Multi-round-trip requests

Some Sqquid tools need user input. The server returns input_required in this case.

The result contains:

• the request that the client must show to the user.
• an opaque requestState value.

The client must collect the response. The client must then retry the original call. The retry must contain the same tool arguments, the user response, and the same requestState value.

Sqquid uses this process for:

• change approvals.
• provider authorization.
• Stripe Checkout.

The request state expires after 30 minutes. Start the tool again after the state expires.

OAuth discovery

Sqquid publishes these documents:

https://mcp.sqquid.com/.well-known/oauth-protected-resource/mcp
https://mcp.sqquid.com/.well-known/oauth-authorization-server

The authorization server supports:

• authorization codes.
• PKCE with S256.
• refresh tokens.
• token revocation.
• Client ID Metadata Documents.

The client must use the MCP resource URI as the OAuth resource:

https://mcp.sqquid.com/mcp

Tool discovery and caching

Use tools/list to get the current tool names and JSON Schemas. Treat the live result as authoritative.

Sqquid marks the tool list as private. The client can cache it for one hour. The client must not share one user’s private tool-list result with another user.

Test a client

Use this minimum test:

1. Connect to the MCP endpoint.
2. Complete OAuth authorization.
3. Call tools/list.
4. Call account_whoami.
5. Call setup_status.
6. Start an approval tool in a test Account.
7. Confirm that the client displays input_required.
8. Decline the request.
9. Confirm that Sqquid does not apply the change.

Do not test write tools in a production Account unless the Account owner approves the test.