**As** an OpenProject developer
**I want to** provide a compliant MCP HTTP endpoint inside OpenProject
**so that** MCP clients can discover and communicate with OpenProject’s available tools, resources, and prompts through a single standard interface

**Acceptance criteria**

* A new endpoint Begin of the insertion`/mcp`End of the insertion Begin of the deletion namespace /mcp/\*End of the deletion exists within OpenProject

* The MCP server responds to:

* Begin of the insertionServer metadata includes:

* End of the insertion Begin of the deletion `GET /mcp/metadata:` returnsEnd of the deletion server Begin of the insertionname

* version

* description

* End of the insertion Begin of the deletion name, version, description,End of the deletion supported endpoints and configuration. Begin of the insertion

End of the insertion Begin of the deletion

End of the deletion * Begin of the insertionMCP server supports `tools/list`, `resources/list` and `prompts/list` requests

* End of the insertion Begin of the deletion `GET /mcp/list_tools, GET /mcp/list_resources, GET /mcp/list_prompts:`End of the deletion minimal stubs return empty or demo data until respective features are implemented. Begin of the insertion


End of the insertion Begin of the deletion


End of the deletion <br>

* `metadata` output follows the Model Context Protocol spec for HTTP transport.

* Endpoint available in development and production modes behind feature flag Begin of the insertion`mcp_server` and enterprise feature `mcp_server`.End of the insertion Begin of the deletion `mcp_enabled`.End of the deletion

* Health check logs confirm valid MCP responses.

<br>


**Technical notes**

* Implement using the [Ruby MCP SDK](https://github.com/modelcontextprotocol/ruby-sdk).

* The Begin of the insertionmetadataEnd of the insertion Begin of the deletion /metadataEnd of the deletion endpoint includes:

* server\_name, version, auth\_method: oauth2\_pkce,

* arrays for available tools, resources, prompts,

* optional admin\_customization: true flag.

<br>


**Permissions and visibility considerations**

* Visible only when Begin of the insertion`mcp_server`End of the insertion Begin of the deletion mcp\_enabledEnd of the deletion feature flag is active.

* Requires authenticated OAuth access token (public apps with PKCE allowed).

* Metadata hides any disabled tools/resources per admin configuration.


**Out of scope**

* Implementing actual tool or resource logic (covered in later features).

* WebSocket or streaming transport.

* UI components for admin configuration (handled in separate features).

<br>