2026-07-28, the stateless revision of the protocol, over streamable HTTP. It speaks only that revision, so clients that support only older ones can’t connect.
Tools
Three tools cover every operation:
Every call to
cadenya_read and cadenya_write takes an operation name from cadenya_discover and an input object. Discover lists only the operations your credential can run, so the client never finds a door it can’t open.
Sign in with your Cadenya account
The server signs clients in with OAuth, and app.cadenya.com is the authorization server. Clients that support client ID metadata documents need no setup: add the URL, approve the sign-in in your browser, and pick the workspaces the client can reach. With Claude Code:claude mcp login opens the sign-in page in your browser. Inside a session, /mcp does the same.
Building your own client? Here are the details:
Send an API key instead
A script, or a client without that sign-in flow, can send an API key as a bearer token. The key’s workspaces and scopes still apply. In a project’s.mcp.json, Claude Code reads the key from the environment. So the file never holds the key, and you can commit it:
.mcp.json
2026-07-28 connects the same way: the URL, plus a browser sign-in or an Authorization: Bearer header.
Want the setup in your repository, behind code review? Use config files instead.