# `Sake.Plug`
[🔗](https://github.com/hattoriai/sake/blob/v0.4.3/lib/sake/plug.ex#L1)

The MCP endpoint. Mount it once per server:

    forward "/mcp", Sake.Plug, server: MyApp.MCP

Options: `server:` (required), `auth:` (`true` protects the endpoint with
`Sake.Auth`; the name of an `external_auth:` configuration of the `Sake`
child, such as `:keycloak`, with the tokens of that authorization server,
see `Sake.Auth.External`), `scope:` (a function of the conn that returns the host's
principal; default `conn.assigns[:sake_scope]`), `origins:` (allowed
`Origin` values for a request that sends one — a request with no `Origin`
header, which is how every non-browser MCP client connects, is always
allowed; default `nil` refuses any `Origin` at all, so a browser client
needs this set explicitly; `:any` allows any `Origin`), `json_limit:`
(bytes, default 4 MB), `keepalive:` (ms between SSE
comments, default 15 000), `secret:` (binary or `{m, f, a}`; default the
`Sake` configuration), `reraise:` (re-raise tool exceptions, for tests).

The endpoint serves the modern protocol (2026-07-28) and the three
handshake-era revisions on the same path.

---

*Consult [api-reference.md](api-reference.md) for complete listing*