Connect an MCP client

Strata's remote MCP endpoint is https://stratatcg.com/connector/mcp. It uses Streamable HTTP and OAuth authorization code with S256 PKCE. Client Identifier Metadata Documents (CIMD) are preferred; Dynamic Client Registration (DCR) supports hosts that need it. A developer does not need to pre-register every CLI user's callback. Your host opens Strata sign-in and permission review, then manages tokens.

Rollout status (October 15, 2026): the production endpoint is enabled. Other deployments can be feature gated; a 503 mcp_unavailable means it has not been enabled on that deployment. Do not report a successful installation until tools can be listed and the connected account can be read. Platform directory approval and actual host execution are separate from protocol compatibility. Muse's submitted native application continues using its existing OAuth and sandbox endpoints.

Choose your host

Directory availability

As of October 15, 2026, Muse’s native application and Grok Bot’s marketplace application are submitted and awaiting review. The Claude directory application remains a draft, although the custom connector completed OAuth and all six tool checks. OpenAI’s application remains a draft and its publisher-portal Connect flow has not completed authorization. Local Codex MCP access is separate from that portal. No directory listing is claimed approved or published. Use only installation controls actually available in the user's host.

Grok Bot custom connection

Ask Grok Bot to add https://stratatcg.com/connector/mcp as a custom remote MCP connector with OAuth. Review the account and permissions on Strata before allowing access. The tested app used a www.cursor.com client identity; confirm the host initiated the flow rather than assuming a client label proves endorsement. After connecting, call strata_account and follow the one-time identify check below. If the installed version does not expose custom connectors, use the signed-in console until the marketplace listing becomes available.

Codex

codex mcp add strata --url https://stratatcg.com/connector/mcp
codex mcp login strata

Keep an existing working Strata connection; inspect it before changing configuration. On hosts supporting explicit registration preference, CIMD is preferred; DCR is a compatibility fallback. Do not invent client IDs or callback URLs. If an older host cannot complete discovery, update it or use its documented bearer-token credential setting.

Claude Code

claude mcp add --transport http --scope user strata https://stratatcg.com/connector/mcp

Then open /mcp in Claude Code and authenticate Strata. A project-scoped connection may be preferable for shared project configuration; credentials must remain in each user's private host store.

Hermes

hermes mcp add --url https://stratatcg.com/connector/mcp --auth oauth strata
hermes mcp login strata

Reload MCP tools in an active session using the host's supported reload control.

OpenClaw

openclaw mcp set strata '{"url":"https://stratatcg.com/connector/mcp","transport":"streamable-http","auth":"oauth"}'
openclaw mcp login strata

Consult the installed version's help before changing an existing configuration.

API-key fallback

Use the existing Strata account dashboard to create one personal API key for that agent. The user copies it directly into the host's private credential input as STRATA_API_KEY; never into chat, command arguments, repository configuration, shell history, logs, or a shared document. A plain configuration file is not a credential vault. A one-turn shell environment does not establish a persistent installation.

A host with a secure injected environment can use Authorization: Bearer ${STRATA_API_KEY} for this MCP endpoint or the personal-key REST API. For Codex, the supported environment reference is configured without embedding a secret:

codex mcp add strata --url https://stratatcg.com/connector/mcp --bearer-token-env-var STRATA_API_KEY

Use this alternative only after the host's secret manager supplies the variable to the actual agent process, including future sessions. OAuth is easier for local clients because the host manages token persistence. If secure credential storage or API execution is unavailable, use the console and say that a native installation has not occurred. Never extract browser cookies to bypass account linking.

Verify and begin

Call strata_account first, confirm the intended existing account and current allowance, then make one strata_identify call:

{
  "operationKey": "strata-setup-charizard-REPLACE-WITH-ONE-UUID",
  "input": {
    "text": "Charizard ex 199/165 151",
    "hints": {"game": "Pokemon"},
    "enrich": false
  }
}

Generate the UUID once and retain the exact arguments for network retries. The operationKey becomes the existing Idempotency-Key header; do not regenerate it after a timeout. Confirm the returned confident identity is Charizard ex 199/165, SV: Scarlet & Violet 151 (TCGplayer 517045). This uses one credit for a successful identity, with no pricing. Then ask what the user wants to identify or price. Do not repeat the lookup on every reconnect.

After this explicit identity-only setup check, ordinary product lookups should identify and price together: set input.enrich:true for strata_identify or strata_slabs unless the user asks otherwise. Reuse returned pricing. Include the established TCGplayer product link and returned card images when supported; follow result presentation for exact fields, slab mapping limits and batch layout.

The tools are strata_account, strata_identify, strata_enrich, strata_slabs, strata_graded, and strata_product. Discover their schemas through MCP. REST schemas remain in OpenAPI. The four lookup tools require an operation key. Account and registry reads do not consume lookup credits. MCP does not expose suggestions, feedback, purchase, plan-change, or administrative tools.

MCP requests, including initialization and tool listing, require authentication. A missing or expired token returns HTTP 401 with a WWW-Authenticate resource-metadata challenge so your host can start sign-in immediately. OAuth discovery metadata remains public.

The four lookup tools deliberately use readOnlyHint: false because they consume lookup allowance and record the idempotent operation. They cannot purchase anything, change a plan, or modify a collection. Hosts may request confirmation before these metered actions. Account and registry reads use readOnlyHint: true; all six tools use destructiveHint: false.

Read images locally with your own image tools and send only relevant text. Confirm ambiguous printing selections. Use the official registry for verified raw/graded links; proposed links are not verified. Missing prices are unavailable, never zero. Preserve currency, source and observation time. Read the complete workflow guide.

Authentication and lifetime

The protected resource and OAuth issuer are both https://stratatcg.com/connector/mcp. Resource metadata is at https://stratatcg.com/.well-known/oauth-protected-resource/connector/mcp; authorization-server metadata is at https://stratatcg.com/.well-known/oauth-authorization-server/connector/mcp. Require resource in authorization and code exchange. Tokens are audience-bound to MCP and cannot be used at the separate Muse sandbox or legacy JSON gateway.

Clients request only account:read cards:read. Tools publish OAuth scope metadata and reconnect challenges. Access tokens last 15 minutes; refresh tokens rotate within a 90-day grant. Reusing a rotated refresh token revokes its family. Keep token refresh serialized per connection. Personal API keys expire separately after 90 days.

CIMD fetches require HTTPS, public DNS destinations, a direct JSON response, matching client_id, and bounded payloads. Exact HTTPS callbacks and native loopback callbacks are supported. Only the port can vary for a loopback registration without a fixed port. Dynamic clients are labelled unverified at consent; registration is not endorsement.

Billing and recovery

Use strata_account before suggesting payment, then the existing billing dashboard. Retain task context while the user reviews payment. Never buy or change a plan without approval. After payment, re-read account allowance and resume unfinished work; a redirect alone does not prove payment. Honor Retry-After; a provider outage is not fixed by upgrading.

Revoke access in the dashboard and remove the host connection when disconnecting. Disconnecting an agent does not cancel a subscription. Cancel billing separately if the user requests it.

Host references

Installation interfaces vary by version. References checked October 14, 2026: Codex MCP, Claude Code MCP, Hermes MCP, OpenClaw transports, OpenAI plugin packaging, dots and apps, and Grok Bot apps.