Connecting a client - Investorlift Data Services

Every client here points at the one route, https://api.investorlift.com/mcp, and sends the same zpka_ key as a bearer header. The clients differ only in where the entry lives and in the name of the entry. Put the key in the environment first (export GM_API_KEY="zpka_..."), so no tracked file carries it.

curl

Two legs answer on the same route. An initialize-era client sends the plain handshake. It gets one text/event-stream frame, and the frame closes as soon as the server writes it:

curl -s -D - "https://api.investorlift.com/mcp" -H "Authorization: Bearer $GM_API_KEY" \
  -H 'Accept: application/json, text/event-stream' -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-11-25","capabilities":{},"clientInfo":{"name":"curl","version":"0"}}}'

HTTP/1.1 200 OK
x-request-id: ef81aef9-...   zp-rid: ef81aef9-...
cache-control: no-cache, no-transform   vary: Authorization   x-accel-buffering: no
x-dataset-version: hou=1789052706,phx=1789053358   x-data-end: hou=2026-08-11,phx=2026-08-12
content-type: text/event-stream

event: message
data: {"result":{"protocolVersion":"2025-11-25","capabilities":{"tools":{"listChanged":false},"resources":{"listChanged":false,"subscribe":false},"prompts":{"listChanged":false},"completions":{}},"serverInfo":{"name":"god-mode","version":"0.9.0"},"instructions":"Read-only county deed, MLS listing and Investorlift marketplace data ..."},"jsonrpc":"2.0","id":1}

The modern 2026-07-28 leg adds three headers and the two _meta protocol keys inside params. The answer is application/json with cache-control: private, no-cache and no x-accel-buffering. Mcp-Protocol-Version and Mcp-Method go on every message. Mcp-Name carries the name or the uri the body names, on a tools/call, a resources/read and a prompts/get alike:

curl -s "https://api.investorlift.com/mcp" -H "Authorization: Bearer $GM_API_KEY" \
  -H 'Accept: application/json, text/event-stream' -H 'Content-Type: application/json' \
  -H 'Mcp-Protocol-Version: 2026-07-28' -H 'Mcp-Method: tools/call' -H 'Mcp-Name: godmode_coverage' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"godmode_coverage","arguments":{},"_meta":{"io.modelcontextprotocol/protocolVersion":"2026-07-28","io.modelcontextprotocol/clientCapabilities":{}}}}'

Swap tools/call for server/discover or tools/list, and drop Mcp-Name: those two methods name nothing. resources/read and prompts/get still need it, with godmode://concepts or who_owns_this_house as the value. Without it the route answers 400 with JSON-RPC -32020. The message says that the request headers and the body disagree, because the body carries params.uri or params.name and the required header is absent.

Claude Code

The key comes out of the environment, so no tracked script carries it on a command line:

claude mcp add --transport http godmode https://api.investorlift.com/mcp \
  --header "Authorization: Bearer ${GM_API_KEY}"
claude mcp get godmode          # prints whether the server is connected

--transport http, --header (repeatable) and --scope local|user|project are the flags claude mcp add --help lists. The equivalent JSON, in .mcp.json at the project root or in the user scope, expands ${VAR} in both url and headers:

{ "mcpServers": { "godmode": { "type": "http", "url": "https://api.investorlift.com/mcp",
  "headers": { "Authorization": "Bearer ${GM_API_KEY}" } } } }

The entry must carry "type": "http". Claude Code skips an entry that has a url and no type. Then claude mcp list prints a configuration warning that names the entry and the type it wants. A refused key shows as a failed connection, not a login prompt, because the server publishes no OAuth metadata. Fix the key and reconnect. In a session the tools appear as godmode_*, the resources as @godmode:godmode://concepts, the prompts as /godmode:find_buyers.

Cursor and VS Code

Same URL, same static headers map. Cursor reads .cursor/mcp.json in the project or ~/.cursor/mcp.json. VS Code reads .vscode/mcp.json and wraps the entries in servers instead of mcpServers:

{ "mcpServers": { "godmode": { "url": "https://api.investorlift.com/mcp", "headers": { "Authorization": "Bearer ${env:GM_API_KEY}" } } } }
{ "servers": { "godmode": { "type": "http", "url": "https://api.investorlift.com/mcp", "headers": { "Authorization": "Bearer ${env:GM_API_KEY}" } } } }

Each shape belongs to its client, not to this server. If a client later moves a key in its shape, the client’s own documentation decides.

MCP Inspector

The smoke test. Pin an exact version, give the key as a header, and read the exit code:

npx --yes @modelcontextprotocol/inspector@2.6.0 --cli "https://api.investorlift.com/mcp" --transport http --stored-auth-only \
  --header "Authorization: Bearer ${GM_API_KEY}" --method tools/list

That runs the initialize-era leg, the Inspector’s default. To run the modern leg, pass a config entry that sets protocolEra and select it with --config <file> --server godmode:

{ "mcpServers": { "godmode": { "type": "http", "url": "https://api.investorlift.com/mcp",
  "headers": { "Authorization": "Bearer zpka_..." }, "protocolEra": "modern" } } }

--stored-auth-only is about OAuth, not about the key. It forbids an interactive login and fails with auth_required instead, which is what an unattended run wants. Against this server it does nothing, because the route publishes no OAuth metadata. The Inspector does not write a key given with --header anywhere. --catalog is the writable file. The Inspector only reads the --config file and never seeds or rewrites it. But that file holds the key in clear text. Keep it out of every repository, and delete it when the run is over.

Claude Agent SDK

An Agent SDK session takes the same server entry as Claude Code, under the SDK’s mcpServers option. The SDK can also replace the list in the middle of a session. The entry shape is Claude Code’s, so type, url and headers are as in Claude Code above. Check the Agent SDK’s own documentation for the option surface. An unattended run takes the same key as an interactive one. The key, not the client, decides what the server serves.

Messages API connector

Available with a zpka_ key. The connector runs from Anthropic’s network and reaches https://api.investorlift.com/mcp like any other client. It sees tools only, no resources and no prompts. It needs the beta header anthropic-beta: mcp-client-2025-11-20 with both halves of the declaration: one mcp_servers entry of type: "url" and one mcp_toolset that names it. The server entry alone is a validation error. The key goes in the server entry’s authorization_token field. This page assumes the field travels as Authorization: Bearer. No live call confirmed that yet. The gateway attributes every call to your account itself, so the connector sends nothing else.

​curl

​Claude Code

​Cursor and VS Code

​MCP Inspector

​Claude Agent SDK

​Messages API connector