Admin MCP

The admin MCP endpoint lets approved AI/admin clients read site state and run small, audited admin actions without sharing dashboard sessions or database credentials.

This documentation page is public so AI assistants can read it. The MCP endpoint itself remains admin-only and requires a valid scoped bearer key.

Public docs page:

https://esportscommunity.net/docs/admin-mcp

Endpoint

Production:

https://esportscommunity.net/api/mcp

Local development:

http://localhost:3000/api/mcp

Headers required by both revisions:

Authorization: Bearer <ec_mcp_live_...>
Content-Type: application/json
Accept: application/json, text/event-stream

JSON-RPC batch arrays are intentionally rejected. Send one MCP request at a time.

Protocol Revisions

Both MCP eras are served on the same URL. The endpoint answers whichever one the request declares, so neither needs a separate address.

• Revision 2026-07-28 — stateless. No initialize handshake and no session id.
• Revisions 2025-11-25 and earlier — the initialize handshake, unchanged. This is still what most clients speak, so the setup below needs no changes.

Deprecated — removal on 2026-09-23. The initialize handshake era is deprecated as of 2026-08-12 and will stop being served on this admin endpoint on 2026-09-23. It goes sooner here than on the public endpoint because every caller holds a key we can identify and contact. Nothing changes before that date. Point your client at 2026-07-28 any time before then; after removal, a handshake request is answered with the unsupported-protocol-version error naming what the endpoint still serves.

Dropping the handshake changes nothing about authorization: the bearer key is required on every request in both eras, and was never carried by the session. An unauthenticated request is still 401.

server/discover reports only 2026-07-28. That is the modern revision it can negotiate, not the full list of what the endpoint serves — legacy clients never call it, they open with initialize.

A 2026-07-28 request mirrors three body values into headers and repeats the protocol version inside params._meta:

POST /api/mcp HTTP/1.1
Authorization: Bearer <ec_mcp_live_...>
Content-Type: application/json
Accept: application/json, text/event-stream
MCP-Protocol-Version: 2026-07-28
Mcp-Method: tools/call
Mcp-Name: get_admin_capabilities

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "get_admin_capabilities",
    "arguments": { "locale": "en" },
    "_meta": {
      "io.modelcontextprotocol/protocolVersion": "2026-07-28",
      "io.modelcontextprotocol/clientInfo": { "name": "YourClient", "version": "1.0.0" },
      "io.modelcontextprotocol/clientCapabilities": {}
    }
  }
}

Mcp-Name is required for tools/call only, and must match params.name. A header that disagrees with the body is rejected with JSON-RPC error -32020; an unsupported protocol version with -32022, which names what this endpoint does support.

Every 2026-07-28 result carries resultType: "complete". tools/list also carries ttlMs and cacheScope — and because your tool set is a projection of this key’s grants, it is cacheScope: "private", so a shared cache must never hold it.

Create A Key

1. Sign in to the dashboard with your admin account.
2. Open /admin/mcp.
3. Create a key for your signed-in Discord account.
4. Choose tools and the smallest useful game/media scopes.
5. Copy the generated ec_mcp_live_… key immediately.

The full key is shown once. The database stores only a SHA-256 hash, short prefix, your owner metadata, scopes, timestamps, and revocation state. Scoped admins can only create and revoke their own keys; super admins can view and revoke all keys.

Tools

Admin MCP includes all public read-only tools, so admins do not need to configure the public MCP separately. Always-on tools are available to every valid admin MCP key. Key-selected tools require an explicit grant on the key.

• get_site_overview (key-selected): Read site and bot counts; admin calls can include scoped dashboard context.
• list_games (always-on): List the localized public game directory.
• get_admin_capabilities (always-on): Discover this MCP key’s usable tools, allowed game and media IDs, and writable stream channel IDs.
• search_news (key-selected): Search published news publicly or admin-visible posts within the key scope.
• get_tournament_status (key-selected): Read matches and standings for one tracked tournament.
• list_tournaments (always-on): List public active tournament summaries.
• get_ewc_club_summary (key-selected): Read EWC club points, qualified games, wins, and region metadata.
• get_ewc_club_standings (always-on): Read the official rank-ordered EWC Club Championship standings from the latest stored snapshot.
• list_co_streams (always-on): List public co-stream groups, live-first.
• search_teams (always-on): Search the public team directory with safe public fields.
• search_players (always-on): Search the public player directory with safe public fields.
• get_public_ewc_leaderboard (always-on): Read the public EWC prediction leaderboard projection.
• list_admin_queue (key-selected): List reported comments needing moderation review.
• create_news_draft (key-selected): Create a draft news post in an allowed game or media channel. Requires idempotencyKey for safe retries and never publishes directly.
• update_stream_channel (key-selected): Update allowed co-stream rows. Requires idempotencyKey for safe retries.

Every successful write records an admin audit entry with actor id mcp:<key-id>:<owner-discord-id>.

Workflow Example

1. Call get_admin_capabilities.
2. Pick an allowed game slug, media slug, or stream channel id from the response.
3. Call create_news_draft or update_stream_channel with that allowed resource.
4. For every write, include a caller-generated idempotencyKey and reuse it only when retrying the exact same operation.

Example write arguments:

{
  "idempotencyKey": "018f7b3d-atomic-draft-001",
  "title": "Draft title",
  "gameSlug": "valorant"
}

Client Setup

Use native Streamable HTTP MCP configuration when your client supports it.

For stdio-only clients such as some Claude Code, Cursor, VS Code, or Codex setups, use mcp-remote:

{
  "mcpServers": {
    "esports-community-admin": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://esportscommunity.net/api/mcp",
        "--header",
        "Authorization: Bearer <MCP_KEY>"
      ]
    }
  }
}

For Codex config.toml stdio setup:

[mcp_servers.esports-community-admin]
command = "npx"
args = [
  "-y",
  "mcp-remote",
  "https://esportscommunity.net/api/mcp",
  "--header",
  "Authorization: Bearer <MCP_KEY>",
]

For Codex versions with native Streamable HTTP support, keep the raw key in an environment variable and reference the variable name:

[mcp_servers.esports_community]
enabled = true
url = "https://esportscommunity.net/api/mcp"
bearer_token_env_var = "ESPORTS_COMMUNITY_MCP_TOKEN"

ESPORTS_COMMUNITY_MCP_TOKEN should contain the raw ec_mcp_live_... key, without Bearer .

Restart the MCP client after changing configuration.

Security Notes

• Admins can create MCP keys only for their own signed-in account.
• Scoped admins can only select scopes already assigned to them.
• Super admins can view and revoke all MCP keys.
• Scope keys to the smallest useful tool/game/media set.
• Treat MCP keys like admin credentials.
• Do not paste real keys into screenshots, commits, issue comments, or shared prompts.
• Revoke old keys after rotation.