The server as an ASGI application serving the MCP endpoint at path
(← FastMCP's http_app). Run it with mooncat, or mount it beside a moonapi
app.
Every message is its own POST, answered with one JSON object, or 202 for a
notification. Sessions, the GET stream and DELETE belong to the
revisions before 2026-07-28 and are optional there; this server keeps no
session, so GET and DELETE answer 405.
A request whose Origin header names another site is refused with 403, as
the transport requires against DNS rebinding. An origin passes when its host
is the request's own Host, a loopback address, or one listed in origins.
docs names the path the documentation page is served at, beside the
endpoint: a browser opened on it lists what the server offers and calls it,
in both eras of the protocol. It is on at /docs unless told otherwise, as
an API framework's interactive docs are; docs=None leaves it off, and a
path equal to the endpoint's is ignored. theme picks its look, the moonmcp
website's by default. The page carries no credentials of its own.