← Home

Agentic access

ThynkQ MCP Server

A small, read-only Model Context Protocol server. It exists because ThynkQ's own product is MCP security tooling and its service line includes AI integration. This is a live, testable demonstration of that competency, not a marketing gimmick bolted onto an unrelated company.

It is read-only, by design

Three tools, all read: get_services, get_pricing, get_case_studies. There are no write tools, no lead capture, and no authentication. Nothing to configure, nothing that touches your data. Every tool reads from the same data modules that render the live /services and /pricing pages, so a tool response cannot say something the website itself does not also say. It also does not report current availability or capacity: that changes week to week, and a stale "we have room" claim in a cached response is worse than no claim at all.

Endpoint

POST https://thynkq.com/api/mcp: JSON-RPC 2.0 over HTTP, following the MCP Streamable HTTP transport. This server answers every request synchronously with a single JSON object (the transport spec allows this as an alternative to opening a Server-Sent Events stream). It does not open an SSE stream, since none of its tools need to push messages to a client. GET on the endpoint returns 405 for the same reason. There is no session negotiation: every request is answered independently from static data.

Tools

get_services

Engagement lanes (Build Readiness Audit, Product Build, Engineering Retainer) and short-term plans (Rescue Sprint, Launch Build), with scope, fit guidance, and URLs.

get_pricing

Current list prices and durations for every lane and short-term plan. No availability or capacity data.

get_case_studies

Published case studies with client, timeline, problem, intervention, and outcome.

Try it

List the available tools:

curl -sX POST https://thynkq.com/api/mcp \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

Call a tool:

curl -sX POST https://thynkq.com/api/mcp \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"get_pricing"}}'

What is verified vs. not

The JSON-RPC message shapes and the Streamable HTTP transport behavior above (POST as the single required method, 202 for notifications, 200 with a JSON body or an SSE stream for requests, 405 on GET when no server-push capability exists) were checked against the official MCP specification. What is not independently verified: whether every MCP client implementation in the wild tolerates a server that never opens an SSE stream, and whether every client requires a session ID this server does not issue. If a client you use fails to connect, that is the most likely reason. Let us know.