Endpoints
MCP server
| Environment | URL |
|---|---|
| Production | https://mcp.dunning.kobana.com.br |
| Sandbox | https://mcp.dunning.sandbox.kobana.com.br |
The server URL is the root of the host — that whole address is what you paste into an MCP client. It is also the OAuth resource identifier, and therefore the aud the token must carry, which is why it has no path.
:::info Availability The dedicated edge for these hosts (distribution, WAF and DNS) is still being provisioned. The server and its tools are ready. :::
Routes served
| Method | Path | Purpose |
|---|---|---|
POST | / | One JSON-RPC message per request. The entire tool surface. |
GET | /.well-known/oauth-protected-resource | Protected-resource metadata (RFC 9728). Public, unauthenticated, cacheable for 5 minutes. |
GET | / | 405 with Allow: POST — this server is stateless and opens no server→client (SSE) stream. |
DELETE | / | 204 — there are no sessions to terminate. |
On the MCP host, any other path answers a JSON 404, whatever the method:
{ "error": { "code": "NOT_FOUND", "message": "Not found." } }
Documentation and API
| URL | |
|---|---|
| Documentation | https://docs.dunning.com.br |
| REST API (production) | https://api.dunning.kobana.com.br |
| REST API (sandbox) | https://api.dunning.sandbox.kobana.com.br |
The REST API is documented in API → Introduction. A token issued for one host is not valid on the other — see Authentication.
Start in sandbox. Destructive tools send real messages to debtors, report them to credit bureaus and protest their debts — the first exploration should not be in production.
:::info Separate host, on purpose The MCP server has its own host rather than a path on the API or app host. The OAuth discovery document has to live at the root of the host; no dashboard cookie is ever sent to this origin, which removes a whole class of confused-deputy problems by construction; and the token audience stays distinct from the API's. :::
Local development
In development the app runs on port 3028 and the endpoint answers at /mcp on the app host — http://localhost:3028/mcp — with the discovery document at http://localhost:3028/.well-known/oauth-protected-resource. Outside development, reaching /mcp through any host other than mcp.dunning.* answers 404: the endpoint does not advertise that it exists somewhere else.