Host MCP

Host exposes authenticated, stateless streamable HTTP MCP at:

http://HOST:PORT/mcp

The safest connection path is Click → Settings → Plugins → Develop panels with an agent → Copy temporary MCP connection. The descriptor contains the MCP URL, protocol version, session ID, expiry, Click ID, and an expiring bearer token. Treat it as a secret.

The client must support protocol 2026-07-28. tools/list includes Host inspection, capability, plugin, task, approval, and paired_click_action tools.

Create a Canvas

Keep the paired Click online, then call paired_click_action:

{
  "action_id": "click.canvas.create",
  "payload": {
    "title": "Service health",
    "html": "<main><h2>Service health</h2><output id=\"status\">Ready</output></main>",
    "css": "main { padding: 16px; }",
    "javascript": "",
    "permission_requests": []
  }
}

Host routes the correlated action to an explicitly identified or unambiguous paired Click. Click stores the source as a content-addressed Host artifact, updates the synchronized workspace, opens the panel, and returns a verification receipt.

Use click.canvas.inspect, update, duplicate, focus, and delete for the rest of the lifecycle. Equivalent click.dascript.* actions are registered. If multiple Clicks are online, pass the copied click_id; ambiguity fails closed.