generated: '2026-08-27'
method: probed
source: >-
  POST https://redocly.com/mcp {"jsonrpc":"2.0","method":"tools/list"} and
  https://redocly.com/.well-known/mcp/server-card.json, both anonymous,
  2026-08-27.
provider: Redocly
providerId: redocly
name: Redocly Docs MCP Server
status: live
description: >-
  Redocly ships a Docs MCP server as a Realm feature and runs it on its own
  documentation site. The endpoint answers anonymously: tools/list returns two
  real tools and resources/list returns the published agent skill. The wire
  surface is deliberately narrow — a sandbox `execute` tool plus a
  `describe-tools` introspection tool — and the actual capability lives in
  eleven sandbox functions callable from inside `execute`.
deployment:
  mode: remote
  endpoint: https://redocly.com/mcp
  transport: streamable-http
  auth: none
  verified: probed
  note: >-
    Anonymous tools/list returned HTTP 200 with a real tools array on
    2026-08-27. Redocly documents that a project with RBAC or requiresLogin
    configured returns 401 to unauthenticated clients; redocly.com's own
    project is public, so the server is open. There is no npx/stdio package —
    the server is generated by Realm per project and is reachable only as a URL.
server_card:
  file: mcp/redocly-mcp-server-card.json
  url: https://redocly.com/.well-known/mcp/server-card.json
  schema: https://static.modelcontextprotocol.io/schemas/mcp-server-card/v1.json
  protocol_version: '2025-11-25'
  server_version: '2026-08-27'
  capabilities: [logging, tools, resources, completions]
openapi: openapi/redocly-docs-mcp-openapi.yaml
docs: https://redocly.com/docs/realm/customization/mcp-server
configuration_reference: https://redocly.com/docs/realm/config/mcp
tools:
  - name: execute
    description: >-
      Run JavaScript in a sandbox against the documentation tools on the global
      `tools` object. No fetch, console, setTimeout, require or Node API — all
      I/O goes through `tools`.
    input_schema_properties: [code, description]
    required: [code, description]
  - name: describe-tools
    description: >-
      Return the exact TypeScript signatures of the sandbox tools available to
      `execute`.
    input_schema_properties: [tools]
    required: []
sandbox_tools:
  note: >-
    Enumerated from the describe-tools inputSchema enum and from an anonymous
    describe-tools call on 2026-08-27. Six returned full TypeScript signatures
    anonymously; five appear in the enum but were not described to an
    anonymous caller, which is consistent with them requiring an authenticated
    Reunite session.
  anonymous:
    - name: listApis
      description: Lists available APIs with their context and purpose.
    - name: getEndpoints
      description: Get all endpoints for a specific API.
    - name: getEndpointInfo
      description: >-
        Get comprehensive information about a specific endpoint including
        parameters, security, and examples.
    - name: getSecuritySchemes
      description: Get the security schemes for a specific API.
    - name: getFullApiDescription
      description: Get the complete OpenAPI description.
    - name: search
      description: Search across the documentation for content matching a query.
  gated:
    - name: contactSupport
    - name: getProjectBuild
    - name: getProjectInfo
    - name: getSubscriptionDetails
    - name: listOrgMembers
resources:
  - uri: https://redocly.com/.well-known/agent-skills/redocly-cli/SKILL.md
    name: redocly-cli
    mime_type: text/markdown
rbac:
  feature_flag: access.rbac.features.mcp
  unauthenticated_response: 401 when the anonymous team has no role
  token_audience_validation: >-
    The server compares a bearer token's aud claim to the organization ID;
    enforcement is off by default and enabled with
    REDOCLY_MCP_ENFORCE_TOKEN_AUDIENCE=true.