=== 2026-09-17T12:14:16Z POST initialize https://api.statsig.com/v1/mcp (no credentials)
HTTP/1.1 200 Connection Established

HTTP/2 401 
access-control-allow-origin: *
content-type: application/json; charset=utf-8
www-authenticate: Bearer realm="statsig", resource="https://api.statsig.com/v1/mcp", resource_metadata="https://api.statsig.com/.well-known/oauth-protected-resource/v1/mcp"
statsig-final-byte-size: 138
content-length: 138
vary: Accept-Encoding
date: Thu, 17 Sep 2026 12:14:16 GMT
referrer-policy: strict-origin-when-cross-origin
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
x-content-type-options: nosniff
content-security-policy: frame-ancestors *.statsig.com
set-cookie: GCLB="914054ec3d6bd84d"; Max-Age=1; Path=/; HttpOnly
via: 1.1 google
alt-svc: h3=":443"; ma=2592000

{"statusCode":401,"message":"This endpoint only accepts an active CONSOLE key, but an invalid key was sent. Key: ","error":"Unauthorized"}
=== GET https://statsigapi.net/console/v1/experiments (no credentials)
HTTP/1.1 200 Connection Established

HTTP/2 401 
cache-control: no-transform
content-length: 12
date: Thu, 17 Sep 2026 12:14:17 GMT
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
x-statsig-region: gke-us-west1
set-cookie: GCLB="a45e14fc28fdf7e5"; Max-Age=1; Path=/; HttpOnly
via: 1.1 google
alt-svc: h3=":443"; ma=2592000

=== POST initialize https://docs.statsig.com/api/mcp (no credentials)
HTTP/1.1 200 Connection Established

HTTP/2 200 
access-control-allow-headers: accept, content-type, mcp-protocol-version, mcp-session-id, x-agent-trace-id, x-agent-session-id, x-mcp-client
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-expose-headers: mcp-session-id
cache-control: no-store
content-type: text/event-stream
date: Thu, 17 Sep 2026 12:14:18 GMT
permissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), bluetooth=(), tools=(self)
referrer-policy: strict-origin-when-cross-origin
server: Vercel
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
x-frame-options: DENY
x-matched-path: /api/mcp
x-vercel-cache: MISS
x-vercel-id: iad1::iad1::pzj7x-1789647258375-975161ee95f4