How does an agent call a remote MCP tool?

Best move: point your agent host at the server’s MCP URL and let the host run the handshake and tools/call for you.

Why it works: MCP is a standard JSON-RPC protocol, so any compliant host speaks it. You add the endpoint once, and the tool shows up like a native function.

Key takeaways

• A remote MCP call is JSON-RPC 2.0 over Streamable HTTP: initialize, then tools/call.
• The agent discovers tools and their argument schemas through tools/list before it calls anything.
• tools/call carries a tool name and an arguments object that matches the tool’s JSON Schema.
• Keyless means no bring-your-own-key. You connect to mcp.bassethound.ai/mcp, sign in when prompted, and call sniff_domain.
• The server returns structured content. For Bassethound that is the five-layer dossier in one response.

What are the steps in a single remote MCP call?

Four moves. First, the client opens a connection to the server endpoint (mcp.bassethound.ai/mcp) over HTTP. Second, it sends an initialize request, where client and server exchange protocol versions and capabilities. Third, tools/list returns the catalog: every tool the server exposes, each with a name, a description, and an input schema. Fourth, tools/call fires the invocation, carrying the tool name and an arguments object. The server runs the tool and returns the result. Every message is JSON-RPC 2.0.

Most agent hosts run all four steps for you once you register the endpoint. From your side you type a request in natural language, and the host maps it to a tools/call. Bassethound exposes one tool, sniff_domain, so the tools/list step returns a single entry and the host knows exactly what to call. There is no ambiguity about which function to invoke, and no menu to navigate. One endpoint, one tool, one call.

How does the agent know what arguments a tool takes?

Through the input schema returned by tools/list. Each tool ships a JSON Schema describing its parameters, their types, and which are required. For sniff_domain the schema declares two fields: domain (a string, required) and profile (an optional enum of fast, standard, or deep, defaulting to standard). The agent reads that schema and builds a valid arguments object before it calls.

This is why you do not hand-write request payloads. The host reads the contract and fills it. If you ask an agent to “sniff stripe.com,” it resolves domain to the hostname and leaves profile at standard unless you asked for depth. Honest limit: the input schema tells the agent the shape of the request, not the shape of the response. Some hosts also read the tool description and any structured-output hints to anticipate the result. Bassethound documents the dossier shape so a host can reason about the return before the call lands, but the schema itself governs the input.

What transport does a remote MCP server use?

Streamable HTTP. The current MCP spec defines two transports: stdio for local servers running as a subprocess, and Streamable HTTP for remote servers reachable over the network. A remote server like Bassethound uses the HTTP transport, which carries JSON-RPC messages over POST and can stream partial results back with server-sent events when a tool runs long.

That streaming matters for the deep profile, where follow-on probes and Wayback history take longer than the fast path. The host can show progress instead of blocking on a single response. Because the transport is plain HTTP, there is no local install, no subprocess, and no binary to ship. You point the host at a URL. The tradeoff is real: a remote server cannot touch your local filesystem or environment the way a stdio server can. For a domain-intelligence tool that is the right shape. Nothing on your machine is relevant to the crawl, so nothing local needs to cross the boundary.

How does authentication work on a keyless server?

Two tiers. Sign in and you are on the free tier; paid plans raise the limit. Bassethound owns the crawl, so you never pass your own provider keys through the server.

Both tiers use OAuth. The MCP authorization spec builds on OAuth 2.1, so a host completes the standard authorization flow and attaches a bearer token; paid plans raise your depth and volume limits on the same connection. The difference from bring-your-own-key tools is structural, not cosmetic. A BYOK server needs your key to do its job, which means credential handling on the first call. Bassethound does the fetching itself, so you bring no key of your own. You sign in once and the client carries the token from there. You get a real answer before you decide whether to pay.

What does the agent get back from tools/call?

Structured content. The response carries the tool result as a content block the host can parse, and, when there is a structured-output schema, a typed object. For sniff_domain the result is the five-layer dossier: tech stack, infrastructure, firmographics, AI-readiness, and security, plus a fused top-level summary with primary_stack, ai_readiness, security_grade, and icp_signal.

One call, five correlated layers, one response. The agent does not stitch together five separate tool results. Bassethound correlates the layers server-side before the payload comes back, so the join between, say, a detected model provider and the SDK that calls it already exists. Honest limit: a static crawl plus optional JS render can miss fully server-side or proxied components. The dossier flags those gaps in the how_detected and confidence fields rather than guessing. You get the evidence trail alongside the verdict, so a low-confidence detection reads as low-confidence instead of hiding.

Bassethound perspective

Fan-out is the lazy answer to enrichment. Wire up five MCP servers, one for tech, one for DNS, one for firmographics, one for security, one for AI signals, and let the agent make five calls and reconcile the results. That looks flexible. It is expensive and it is wrong. The agent pays five round trips, five handshakes, and five schemas to reason about, then has to correlate layers that were never joined. Correlation is the hard part and the valuable part. Whether the model provider on the AI layer matches the SDK on the tech layer, or whether the CDN on the infra layer explains a missing security header, those joins only exist when one server sees all five layers at once. Bassethound exposes a single tool over a single call, so the agent runs one tools/call and gets a dossier that is already correlated. A competitor selling you a fan-out of single-purpose MCPs will call composition a feature. For domain intelligence it is a tax. The call boundary is where fusion happens, and we put it in one place.

Sources

• Model Context Protocol specification: https://modelcontextprotocol.io/specification
• Model Context Protocol documentation: https://modelcontextprotocol.io/docs
• MDN, Server-sent events: https://developer.mozilla.org/en-US/docs/Web/API/Server-sent_events
• OAuth 2.1 draft (IETF): https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1