Connect a client

The server speaks the protocol rather than any one vendor’s dialect, so any spec-compliant client works. What differs between them is only where the configuration lives.

Create a key

Create a Nylon API key on the API keys page. Issue a separate one for agent use so you can revoke it without interrupting your backend.

Add the server

Use the snippet for your client below. The URL is https://mcp.nylon.dev and the key goes in an Authorization: Bearer header.

Check the tools appeared

Ask the agent to list your connected accounts. It should call list_profiles and come back with the accounts on your Nylon organization.

Clients that send a header

Most clients let you set request headers on a remote server, which is all this one needs.

claude mcp add --transport http nylon https://mcp.nylon.dev \
  --header "Authorization: Bearer nylon_live_YOUR_API_KEY"

{
  "mcpServers": {
    "nylon": {
      "url": "https://mcp.nylon.dev",
      "headers": {
        "Authorization": "Bearer nylon_live_YOUR_API_KEY"
      }
    }
  }
}

{
  "servers": {
    "nylon": {
      "type": "http",
      "url": "https://mcp.nylon.dev",
      "headers": {
        "Authorization": "Bearer nylon_live_YOUR_API_KEY"
      }
    }
  }
}

Cursor reads .cursor/mcp.json in a project or ~/.cursor/mcp.json globally; VS Code reads .vscode/mcp.json. Check your client’s own documentation if it has moved.

Clients that do not

Some clients only accept a remote server that authenticates with OAuth, and Nylon deliberately uses API keys instead — see Scope and safety for why. Bridge them with mcp-remote, which runs locally, speaks stdio to the client and adds the header on the way out:

claude_desktop_config.json

{
  "mcpServers": {
    "nylon": {
      "command": "npx",
      "args": [
        "-y", "mcp-remote", "https://mcp.nylon.dev",
        "--header", "Authorization: Bearer nylon_live_YOUR_API_KEY"
      ]
    }
  }
}

The bridge is a local process holding your key. Treat that config file the way you treat any other file with a secret in it.

Your own client

There is nothing to install. The endpoint is JSON-RPC 2.0 over HTTP POST, stateless, and answers application/json:

curl -X POST https://mcp.nylon.dev \
  -H "Authorization: Bearer nylon_live_YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "tools/call",
    "params": {
      "name": "list_profiles",
      "arguments": { "limit": 5 }
    }
  }'

A conversation normally opens with initialize, then tools/list, then tools/call — but since nothing is remembered between requests, a client that only ever calls tools/call works too.

Method	Returns
`initialize`	The negotiated protocol version, the server’s capabilities and usage instructions for the model.
`tools/list`	All fourteen tools with their JSON Schema and behaviour hints.
`tools/call`	The tool’s result.
`ping`	An empty result, for liveness.

GET https://mcp.nylon.dev returns the protocol version, the authentication scheme and the tool names. It is a quick way to check a key-less environment is reaching the right server.

Protocol details

Transport

Streamable HTTP. There is no SSE stream and no Mcp-Session-Id: the server never initiates, so there is nothing to subscribe to.

Protocol version

2025-06-18, with 2025-03-26 and 2024-11-05 accepted at initialize for older clients.

Capabilities

Tools only. The server advertises no resources or prompts, and its tool list does not change at runtime.

CORS

Open, so a browser-based client can call it directly. The key still has to come from somewhere you trust.

Get started

Reference

Clients that send a header

Clients that do not

Your own client

Protocol details

Transport

Protocol version

Capabilities

CORS

​Clients that send a header

​Clients that do not

​Your own client

​Protocol details

Transport

Protocol version

Capabilities

CORS

Clients that send a header

Clients that do not

Your own client

Protocol details