Run one MCP tool with a delegated token

POST

/security/mcp/call

The tool is looked up in the shared MCP registry, and the HTTP call it
stands for is derived from the registry — the arguments only fill its
path segments and body. The call is then run through this API as the
token's owner, with the capabilities narrowed to what was checked, so
the target route's own authentication, ownership and capability checks
still apply. The answer is that route's answer, with an
X-Prorm-Mcp-Tool header.

Checked here: the tool's needs against the token's live capabilities
(and data:read / data:write by a query's intent), the resource
lock, no admin tools, a confirmation for a destructive tool, and a
fresh step-up for a stepUp tool — which a delegated token can never
make. An unknown tool and a forbidden one get the same 404.

Capability: none from the table; the credential is its own (see above). A delegated MCP client token; the tool's needs, re-derived from the registry.

Request

Authorization

Bearer Token

Provide your bearer token in the

Authorization

header when making requests to protected resources.

Example:

Authorization: Bearer ********************

Body Params application/jsonRequired

Examples

Responses

🟢200

The derived route's answer (its own status and body)

Headers

This response does not have a body.

🟠400

🟠401

🟠403

🟠404

🟠423

🟠428

🔴503

Request Example

Shell

JavaScript

Java

Swift

curl --location 'https://api.prod-orm.io/security/mcp/call' \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '{
    "tool": "prorm_list_databases",
    "arguments": {
        "property1": "string",
        "property2": "string"
    }
}'

Response Example

400 - Example 1

{
    "error": "capability_missing",
    "message": "This session cannot do that",
    "property1": "string",
    "property2": "string"
}

Modified at 2026-10-05 04:04:32

What a delegated token may do now

Run a device-signed MCP tool call relayed by the MCP Worker