Sessions and limits

Transport

The Nylon MCP server speaks Streamable HTTP at https://mcp.usenylon.com/mcp. It supports MCP versions 2025-11-25, 2025-06-18, 2025-03-26 and 2024-11-05.

Method	Use
POST /mcp	Send JSON-RPC requests. An initialize request starts a session.
GET /mcp	Open a server-sent event stream for an existing session.
DELETE /mcp	End a session.

Every request needs Authorization: Bearer <access_token>. Responses come back as JSON.

Sessions

Sessions are stateful.

1. Your initialize request returns an Mcp-Session-Id response header.
2. Send that header on every later request in the session.
3. When you’re done, DELETE /mcp with the header to close the session.

Rule	Value
Idle timeout	A session closes after 2 hours without a request.
Live sessions per user	Up to 100. Opening another closes that user’s least recently used session.
Server restarts	Sessions don’t survive a restart or a new release. Expect occasional 404s and re-initialise.
Unknown or closed session	404 with JSON-RPC error -32001 “Session not found”. Send a new initialize.
Request without a session header	Any request other than initialize without an Mcp-Session-Id header gets 400 with JSON-RPC error -32000.

Most MCP clients re-initialise automatically after a 404.

Tool limits

Limit	Value
Searches per search_library call	1 to 5, run in parallel
Filter values per search	Up to 3 jurisdictions, 3 contentTypes and 20 practiceAreas
Query length (q, phrase)	400 characters
Results per search (limit)	1 to 50, default 10. Page with offset.
Whole-document read	About 50,000 tokens, then truncated. Use search-within (phrase) for the rest.
Library request timeout	20 seconds, with up to two retries on network errors, timeouts, 429 and 5xx

A search that breaks a filter cap, or a library request that still fails after retries, comes back as tool text (“Search failed. …” or “Read failed. …”), not a protocol error, so the assistant can explain or retry. See Errors.

Rate limits

Nylon’s sign-in endpoints (/oauth/register and /oauth/token) are rate-limited per IP address. Over the limit, they return 429 with {"error":"temporarily_unavailable"}.

A 429 on a token refresh is temporary. Back off and retry with the same refresh token; don’t discard it or send the user back through sign-in.

Browser clients

The MCP endpoint allows cross-origin requests from any origin, because it authenticates with bearer tokens, not cookies. It allows the content-type, authorization, accept, mcp-session-id and mcp-protocol-version request headers, and exposes www-authenticate and mcp-session-id to scripts.

Sign-in is different. Nylon’s sign-in endpoints don’t allow cross-origin requests, so run sign-in on a server or in a native app, not in a web page.