What it cannot do

• Hosted HTTP does not expose password login tools. Use OAuth in the client.
• Respondent file uploads and card payments still use the hosted form page. Owner tools can start Stripe Connect and Checkout and return a URL. Avatars and platform admin stay on the website.

The machine-readable MCP manifest is /.well-known/mcp.json. Streamable HTTP is at /mcp.