{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "title": "Maha Strategies Enterprise MCP Gateway - canonical v1 contract",
  "version": "0.2.0",
  "documentation": "https://www.mahastrategies.com/enterprise-mcp-gateway",
  "guide": "https://www.mahastrategies.com/guides/enterprise-mcp-governance",
  "transport": "JSON-RPC 2.0 MCP messages over HTTPS POST",
  "gatewayEndpoint": "https://www.mahastrategies.com/api/v1/mcp/gateway/{serverId}",
  "authorization": {
    "scheme": "Bearer",
    "credential": "Provisioned Maha tenant API key",
    "tenantBinding": "The verified API key tenant and registered upstream tenant must match. A caller cannot select a tenant header."
  },
  "registration": {
    "endpoint": "https://www.mahastrategies.com/api/v1/mcp/register",
    "authentication": "Provisioned Maha tenant API key",
    "upstreamRequirements": ["HTTPS", "public DNS hostname", "no embedded URL credential", "bounded JSON-RPC response"],
    "authTypes": ["none", "bearer", "hmac"],
    "credentialStorage": "Bearer and HMAC secrets are encrypted with AES-256-GCM and are never returned.",
    "discovery": "A bounded tools/list request persists credential-safe tool names, descriptions, and input schemas."
  },
  "serverPolicy": {
    "endpoint": "https://www.mahastrategies.com/api/v1/mcp/servers/{serverId}",
    "method": "PATCH",
    "rule": "Every method is explicit. tools/call requires one or more allowedToolNames from the latest validated discovery inventory.",
    "statusValues": ["active", "suspended"]
  },
  "slaControls": {
    "endpoint": "https://www.mahastrategies.com/api/v1/mcp/settings",
    "fields": ["requestsPerMinute", "timeoutMs", "failureThreshold", "cooldownMs"],
    "scope": "Tenant-wide rate controls and per-server circuit state"
  },
  "enforcement": {
    "requestBodyRetention": "none",
    "upstreamCredentialsReturned": false,
    "browserOriginRequests": false,
    "streamingResponses": false,
    "maxRequestBytes": 65536,
    "maxResponseBytes": 1000000,
    "redirects": "blocked",
    "audit": "Successful forwarding records method, server, latency, request hash, and ledger outcome without retaining tool arguments or response bodies."
  },
  "supportedMethods": ["initialize", "notifications/initialized", "ping", "tools/list", "resources/list", "resources/read", "prompts/list", "prompts/get", "tools/call"],
  "notYetImplemented": ["private-network upstreams", "upstream OAuth token exchange", "SSE streaming", "runtime content inspection", "prompt-injection analysis", "automatic remediation"],
  "legacyCompatibility": {
    "paths": ["/api/mcp-gateway/{serverId}", "/api/admin/mcp-gateway"],
    "status": "Compatibility only; not the canonical customer contract."
  }
}