Connect with MCP

Cronbolt exposes a remote Streamable HTTP MCP server at:

https://api.cronbolt.com/mcp

It implements MCP 2026-07-28 with the official Python SDK 2.x. Modern requests are stateless, and older MCP clients can still negotiate the previous initialization flow on the same endpoint.

Connect a client

Add the endpoint above as a Streamable HTTP server.
Follow the browser prompt and log in to Cronbolt.
Choose the project the agent should manage and approve access.

Cronbolt uses OAuth 2.1 authorization code with S256 PKCE. The client receives a one-hour, MCP-only access token and a rotating refresh token. Your browser session and Cronbolt login credentials never go to the MCP client.

The selected project is the complete authorization scope. The MCP server cannot access another project, account details, or billing. Open Settings, select the project, and disconnect a client to block its next request.

API key fallback

For a headless client that cannot open the OAuth flow, create a project API key in Settings, store it as CRONBOLT_API_KEY, and send it only in this header:

Authorization: Bearer $CRONBOLT_API_KEY

Never paste an API key into a prompt or tool input.

Available tools

Tool	Purpose
`get_project_context`	Check project identity and current plan limits
`list_jobs` and `get_job`	Inspect recurring jobs and one-time requests
`create_recurring_job`	Create a cron-based HTTP callback
`schedule_one_time_request`	Schedule one future HTTP callback
`pause_job` and `resume_job`	Change recurring job state
`run_job_now`	Queue an immediate delivery
`list_job_runs` and `get_job_run`	Inspect redacted delivery history
`retry_job_run`	Retry a failed recurring run from its stored snapshot
`delete_job`	Delete a job after human confirmation

Create, run-now, and retry tools require an idempotency key. Reusing the same key with the same arguments returns the original result. Reusing it with different arguments returns an error.

What MCP 2026-07-28 changes

The release removes the initialization handshake and protocol-level HTTP sessions. Each request carries its protocol version and client capabilities, so any healthy Cronbolt API replica can handle it without session affinity.

It also hardens OAuth discovery and authorization response issuer validation, adds server/discover, replaces the separate GET notification stream with subscriptions/listen, replaces server-initiated requests with multi round-trip results, requires standard routing headers such as Mcp-Method, and adds cache hints to list results. Roots, sampling, protocol logging, and HTTP+SSE are deprecated for new implementations.

Cronbolt tools do not need server-to-client requests or long-lived subscriptions. They return one JSON result per POST, which keeps the scheduling path stateless and straightforward to retry.

Same rules as the API

MCP is another entry point to the existing Django business operations. It keeps the same callback safety validation, plan limits, overlap protection, idempotency, run retention, redacted responses, and PostHog event allowlist as the public API.

For advanced request fields or a client without MCP, use the API reference.