MCP server - SportQuanta

SportQuanta exposes the customer-facing operations in its canonical REST reference through a stateless MCP Streamable HTTP endpoint:

https://sports-assistant.sportquanta.com/mcp

The endpoint supports MCP protocol 2026-07-28 only. It accepts one POST per request and returns either JSON or request-scoped Server-Sent Events when the protocol requires streaming. It does not expose a long-lived GET stream, does not create MCP sessions, and never returns Mcp-Session-Id.

Connect

Create a workspace API token in the SportQuanta dashboard. Configure a client that supports MCP 2026-07-28 and Streamable HTTP:

{
  "mcpServers": {
    "sportquanta": {
      "type": "http",
      "url": "https://sports-assistant.sportquanta.com/mcp",
      "headers": {
        "Authorization": "Bearer <SPORTQUANTA_API_TOKEN>"
      }
    }
  }
}

Every POST must carry these HTTP headers:

Authorization: Bearer <workspace-api-token>
MCP-Protocol-Version: 2026-07-28

Modern clients negotiate with server/discover. There is no legacy initialize / notifications/initialized handshake. The client also includes the protocol, client information, and capabilities in the required per-request _meta envelope; conforming SDKs add these fields automatically.

Authentication and billing

The MCP service does not keep a global customer token and does not connect to SportQuanta databases. It validates the caller token against the quota-free GET /v1/sports public endpoint, then forwards that same Bearer token to the REST operation selected by the tool. The public REST API remains the authority for scopes, plan entitlements, quotas, rate limits, and billing. A data tool therefore has the same access and cost behavior as calling its REST equivalent directly; the MCP layer does not meter it a second time. server/discover and tools/list perform only the quota-free authentication check.

Tool discovery

tools/list returns 152 explicit tools, one for every eligible operation in the canonical public OpenAPI document. Health, readiness, metrics, admin, webhook-ingress, internal, and service-to-service routes are not tools. There is no unrestricted method/path proxy. Optional analytics-proxy routes and WebSocket channels use separate protocols and are not in this catalog. See the Agent tool reference for naming and input behavior, or the API Reference for each operation’s parameters and response envelope.

Security

Use a dedicated workspace API token for each integration.
Never put a token in source control or browser-side application code.
Revoke a token from the dashboard when an integration is retired.
The token is never exposed as a tool argument or written to MCP logs.
Send your own X-Request-Id or X-Correlation-Id when you need end-to-end request tracing; the MCP service forwards supported correlation headers.

Errors

Transport and authentication failures are JSON-RPC errors with an appropriate HTTP status. A REST failure during tools/call is returned as a tool result with isError: true and safe structured fields:

{
  "error": {
    "code": "rate_limited",
    "message": "Rate limit exceeded.",
    "operationId": "getSportquantaGameBestOdds",
    "httpStatus": 429,
    "requestId": "req_123"
  }
}

Condition	Behavior
Missing or malformed token	HTTP `401` before MCP dispatch
Invalid or revoked token	REST-authenticated HTTP `401`
Wrong protocol or legacy session request	HTTP `400` with supported version
REST `400`, `403`, `404`, or `429`	Structured tool error preserving status, code, message, and request ID
REST `5xx` or unreachable API	Safe `upstream_error` or `upstream_unreachable` tool error
REST timeout	`upstream_timeout` tool error
Client cancellation	The upstream REST fetch is aborted

​Connect

​Authentication and billing

​Tool discovery

​Security

​Errors

Connect

Authentication and billing

Tool discovery

Security

Errors