Version: 2.2.0

Protocol: Model Context Protocol (MCP)

Transport: Streamable HTTP

1. Server Identity

Returned during the MCP handshake:

{
  "name": "jusmundi-assistant",
  "version": "2.2.0"
}

Legal research assistant powered by JusMundi. Use the legal_research tool to ask legal research questions and receive structured results with citations to legal documents.

2. Authentication

The MCP server uses OAuth 2.0 with Protected Resource Metadata (RFC 9728) for standard-compliant discovery and authentication.

2.1 OAuth client configuration

Jus Mundi will provide a client ID and client secret that can be configured in the MCP client to send with requests.

2.2 Discovery flow

1. If a request is made without a valid token, the server responds with HTTP 401 and a WWW-Authenticate header:

   HTTP/1.1 401 Unauthorized
   WWW-Authenticate: Bearer resource_metadata=https://<host_placeholder>/.well-known/oauth-protected-resource
   

2. The client fetches the protected resource metadata:

   GET /.well-known/oauth-protected-resource
   

   Response:

   {
     "resource": "<https://mcp.jusmundi.com>",
     "authorization_servers": ["https://<keycloak_issuer>/realms/jus_mundi"],
     "scopes_supported": ["openid", "mcp:tools:legal_research"],
     "bearer_methods_supported": ["header"],
     "resource_name": "JusMundi Legal Research Assistant (MCP)"
   }
   

3. The client discovers the authorization server's endpoints via standard OIDC discovery at the issuer URL and obtains an access token (JWT) through an OAuth 2.0 flow (e.g. Authorization Code with PKCE).

2.3 Authenticated requests

All MCP requests must include the access token as a Bearer token:

Authorization: Bearer <access-token>