What you will accomplish
- Distinguish an expected GET 405 from a failed POST handshake
- Validate headers and MCP sessions
- Diagnose public, authenticated, permission, and approval errors separately
- Save an error report with secrets removed
Before you begin
- The exact client and version
- Timestamped request/response headers with secrets removed
- The live Quote.Trade discovery file
Verify the official endpoint
Open the official discovery file and confirm that it points to https://quote.trade/mcp before testing any client.
Interpret GET 405 correctly
GET /mcp should return 405 because the endpoint expects POST JSON-RPC. This proves the route exists; it does not prove an MCP handshake succeeds.
Initialize before sending ping or tool calls
Send initialize with required headers. Preserve MCP-Session-Id when returned, then send notifications/initialized. Only then use ping, tools/list, or tools/call.
Check required headers and JSON-RPC structure
Use Content-Type: application/json, Accept: application/json, text/event-stream, and MCP-Protocol-Version: 2025-06-18. Include id on requests that expect a response; omit id on notifications.
Separate server, client, and upstream errors
An MCP protocol error differs from an upstream Quote.Trade API error returned by a tool. Record HTTP status, JSON-RPC code/data, tool name, upstream endpoint, and whether execution status is known or unknown.
Save a reproducible error report
Include the UTC time, endpoint, client or Inspector version, runtime, non-secret headers, request method, request body, response, and exit code. Remove API keys, secrets, signatures, session tokens, approval tokens, wallet details, and balances.
Common problems and fixes
The response is HTML, not JSON or event-stream
Check whether a proxy, WAF, or wrong URL handled the request before the MCP service.
Only one client fails
Compare its Streamable HTTP support, headers, proxy settings, and protocol version with MCP Inspector.
Public tools work but account tools fail
Verify server-side credentials, account permissions, and authentication configuration without exposing secrets to the client.
Order preview works but place_order fails
Inspect explicit approval, trading-enabled state, symbol allowlist, notional cap, leverage gate, and credential permissions.