Skip to main content
Diagnose MCP from the transport boundary inward: service discovery, authentication, session, catalogue, then the selected operation. Do not begin by repeatedly calling a mutation.

Fast health checks

Check public discovery:
Then verify the authenticated endpoint without sending a JSON-RPC operation:
HEAD /mcp confirms endpoint, credential, and origin reachability. It does not initialize an MCP session.

HTTP outcomes

JSON-RPC errors

JSON-RPC errors normally arrive in an HTTP 200 response:

Common symptoms

Run tools/list directly and read revo://context/effective. The key may have only read roles, the requested capability may be unavailable to that identity, or the client may be displaying a cached catalogue. Reconnect after changing roles; do not grant administrator access only to make setup easier.
Confirm that the client can read the Mcp-Session-Id response header from initialize and sends it on all later POST and GET requests. Do not look for the id inside the JSON-RPC result body.
The session expired or no longer matches the credential. Initialize again and replace the locally stored session id. If the key was rotated, always establish a fresh session with the new key.
The SSE connection is a heartbeat/listening channel, not the result transport. Reconnect it with the same valid session id. Tool results continue to return from POST /mcp.
Refresh tools/list, compare the submitted object with inputSchema, include required properties, and remove undeclared fields. A synchronized tool contract may have changed since the client cached it.
Inspect classificationMode, possibleSafetyTiers, and mutationIntent. An argument-dependent tool can expose both read and mutation operations. Present confirmation based on the selected operation and target.
Test the remote HTTPS endpoint and its Secret bindings, then review transport type and connection timeout. A connection test and manifest synchronization are separate lifecycle steps. Keep the plugin disabled if the current remote contract cannot be reviewed.

Safe retry rules

  • Retry initialize, discovery, resource reads, prompts, and other confirmed reads with bounded exponential backoff.
  • Honor Retry-After on 429.
  • On 404, create a new session rather than retrying the old id.
  • On an uncertain write failure, inspect the returned execution identifier or affected resource before issuing the call again.
  • Do not automatically retry destructive or external operations unless their documented contract is idempotent.
  • Keep batch size and parallel calls bounded; rate policy counts contained tool and mutation calls.

Evidence to collect

When escalating an MCP problem, provide:
  • timestamp and environment;
  • client name and version;
  • HTTP status and JSON-RPC error code;
  • JSON-RPC method name;
  • whether failure occurred before or after initialization;
  • RevoEngine execution or operation identifier when returned;
  • redacted request shape and tool name;
  • whether a fresh session reproduces the issue.
Never attach an API key, full authorization header, Secret value, session id, private tool output, or unredacted customer payload.

Protocol and sessions

General API errors

Last modified on September 7, 2026