Run a device-signed MCP tool call relayed by the MCP Worker

For the MCP Worker, not for clients. The Worker relays a request a
device signed for the MCP endpoint (POST https://mcp.prod-orm.io/mcp
or /mcp/account, per MCP_ORIGINS): the device's Klock grant, the
signature headers, and the exact body bytes. The API verifies it as
the Klock scheme would have — grant, RFC 9421 signature, single-use
nonce, live session, live capabilities — and takes the tool and its
arguments from the signed JSON-RPC tools/call only; the Worker's
own tool and arguments, when sent, must agree. A compromised
Worker can neither invent nor replay a call.

Then the same rules as POST /security/mcp/call: the tool's needs
against the session's capabilities, confirmation for a destructive
tool, a fresh step-up for a stepUp tool (which a Klock session can
make), no mutating admin tools. The call runs as the device session's
owner and answers with the derived route's answer.

The credential is in the body, not in Authorization.

Capability: none from the table; the credential is its own (see above). Klock grant + RFC 9421 over the MCP request; the tool's needs.

curl --location 'https://api.prod-orm.io/internal/mcp/forward' \ --header 'Content-Type: application/json' \ --data '{ "grant": "string", "url": "http://example.com", "headers": { "property1": "string", "property2": "string" }, "body": "string", "tool": "string", "arguments": {} }'

Run a device-signed MCP tool call relayed by the MCP Worker

Request

Responses