MCP

POST https://ervazo.com/api/mcp with the same bearer key as the REST API. The Public API flag must be on. See the REST page for creating, revoking and the limit of eight keys.

GET /api/mcp needs no key and only says where to post.

{
  "name": "ervazo",
  "mcp": "POST /api/mcp",
  "protocol": "2025-03-26"
}

Every POST message is one JSON-RPC object. jsonrpc is 2.0. id is returned unchanged, even if it is a string. A notification without an id whose method starts with notifications/ receives 202 and an empty body.

The body may be 40,000 bytes. Larger is 413, outside JSON-RPC. Invalid JSON is error code -32700, HTTP 400.

Methods this server knows: initialize, ping, tools/list, tools/call. Anything else is -32601, Method not found. An HTTP method other than GET or POST is 405.

A client that supports an external HTTP server points to the POST address and sends the key with it. Replace the key. Do not put it in a shared repo.

{
  "mcpServers": {
    "ervazo": {
      "url": "https://ervazo.com/api/mcp",
      "headers": {
        "Authorization": "Bearer nal_jouw_sleutel"
      }
    }
  }
}

The client should send initialize first, then tools/list, and tools/call for each action. Ervazo does not push a list change: capabilities.tools.listChanged is false.

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "initialize",
  "params": {
    "protocolVersion": "2025-03-26",
    "capabilities": {},
    "clientInfo": { "name": "voorbeeld", "version": "1.0.0" }
  }
}

params are not checked. The response names the protocol and the server.

{
  "jsonrpc": "2.0",
  "id": 1,
  "result": {
    "protocolVersion": "2025-03-26",
    "capabilities": { "tools": { "listChanged": false } },
    "serverInfo": { "name": "ervazo", "version": "1.0.0" }
  }
}

Empty result. Useful for testing the key and the flag without touching a dossier.

{ "jsonrpc": "2.0", "id": 2, "method": "ping" }

{ "jsonrpc": "2.0", "id": 2, "result": {} }

The six tools, with JSON Schema. additionalProperties is false. An extra field in arguments is ignored on the call because only the known fields are read, but a strict client should not send them.

{ "jsonrpc": "2.0", "id": 3, "method": "tools/list" }

name is the tool name. arguments is an object. The result is not standalone JSON-RPC data, but text in content. That text is itself JSON. isError is true if the dossier is missing or the input is refused.

{
  "jsonrpc": "2.0",
  "id": 4,
  "method": "tools/call",
  "params": {
    "name": "list_dossiers",
    "arguments": {}
  }
}

{
  "jsonrpc": "2.0",
  "id": 4,
  "result": {
    "content": [
      { "type": "text", "text": "{\"dossiers\":[]}" }
    ],
    "isError": false
  }
}

So parse text once more. An unknown name puts {"error":"Onbekend hulpmiddel."} in that text, and isError true.

list_dossiers

No arguments. The same list as GET /api/v1/dossiers: id, reference, line, phase, status, name, death. No documents and no BSN.

get_dossier

Required: dossierId. Response under dossier: id, reference, line, phase, status, firstName, lastName, birth, death, residence. No private notes.

{ "name": "get_dossier", "arguments": { "dossierId": "…" } }

list_parties

Required: dossierId. Each person involved has id, type, name, email, relation and portal. The person's private note is not included.

list_tasks

Required: dossierId. Each task has id, title, due and status.

add_task

Required: dossierId and title. due is optional, format YYYY-MM-DD. Without a valid date it becomes today. title is trimmed to 200 characters. An empty title is an error. So is a closed dossier. The task is open and is entered in the audit log as api.task.

{
  "name": "add_task",
  "arguments": {
    "dossierId": "…",
    "title": "Polis opvragen",
    "due": "2026-11-12"
  }
}

add_note

Required: dossierId and body. At most 4,000 characters after trim. The note is internal, author API, and does not appear in the heirs' portal. The audit log receives api.note.

{
  "name": "add_note",
  "arguments": {
    "dossierId": "…",
    "body": "Verzekeraar gevraagd om de polis."
  }
}

• 401 — The same key error as the REST API, before JSON-RPC.
• 403 — API off, or account paused.
• 429 — More than 120 requests per minute for this key. REST and MCP count together.
• 413 — Body larger than 40,000 bytes.
• 400 en -32700 — The body is not JSON.
• -32601 — Unknown method.
• Dossier not found — HTTP 200, isError true, text is the sentence Dossier niet gevonden.
• Empty title, empty note or closed dossier — HTTP 200, isError true, text is JSON with error.

A missing dossier is therefore not an HTTP 404 in MCP. Only the text and isError say so.

One key, one account. No files, no BSN, no deleting, no invitation and no division. Writing to a closed dossier stops. The REST page describes the fields that come back in the text JSON.

Back to the REST API