Router endpoint

Use the router when the caller needs to find and select an application. The packaged shared HTTPS route is /api/application/mcp, which forwards to the router on port 5194. Deployments that support a personal URL in the application account card send it to the same router. The router validates the URL against the issuer and subject of the MCP-audience access token.

Discover, select and verify

1. Call read_v2_session_identity with {} and verify the returned identity. Then call list_v2_applications. For another page, supply the returned nextAfter as after until it is null.
2. Pass the selected row's stable IDs to list_v2_functions as workspace_id and application_id. Verify listener.scope is routed_application and match both IDs.
3. Use the same scope arguments on each application-scoped request through the router. For example, the routed read_v2_program requires both IDs plus program. See Select and discover for the exact arguments and the next bounded read.

A valid identity can still lack enrollment or the target grant. If a personal URL returns PERSONAL_MCP_IDENTITY_MISMATCH, use the account that owns the URL or get the correct URL for your account. If a release lacks personal routing, use the operator-provided shared router URL with your own credentials.