# Connect an MCP client

Strata's remote MCP endpoint is `https://stratatcg.com/connector/mcp`. It uses Streamable HTTP and OAuth authorization code with S256 PKCE. Client Identifier Metadata Documents (CIMD) are preferred; Dynamic Client Registration (DCR) supports hosts that need it. A developer does not need to pre-register every CLI user's callback. Your host opens Strata sign-in and permission review, then manages tokens.

**Rollout status (October 15, 2026):** the production endpoint is enabled. Other deployments can be feature gated; a `503 mcp_unavailable` means it has not been enabled on that deployment. Do not report a successful installation until tools can be listed and the connected account can be read. Platform directory approval and actual host execution are separate from protocol compatibility. Muse's submitted native application continues using its existing OAuth and sandbox endpoints.

## Choose your host

| Host | Installation path | Verification required |
| --- | --- | --- |
| Muse | Prefer the Strata native connector when available in your account. Use its existing account-linking control. | Native listing remains subject to platform review. Do not replace the submitted OAuth registration with the MCP registration. |
| Codex CLI / local Codex | Add the remote MCP server, then sign in with the commands below. | Confirm tools appear in a new session and call `strata_account`. |
| Claude Code | Add the HTTP server, then use `/mcp` to authenticate. | Confirm tools and the connected account. |
| Hermes | Add the URL with OAuth, then authenticate using its MCP controls. | Confirm tools are loaded in the active agent. |
| OpenClaw | Configure Streamable HTTP with OAuth using its MCP CLI. | Confirm tools and account. “Claudebot” is not a universal product identifier; verify the actual host/version before applying these commands. |
| ChatGPT / Codex dots | Install/enable the Strata account plugin when available. Developers can test a custom remote MCP plugin through the supported Plugins UI. | Local Codex MCP configuration alone does not install an account plugin or make it available to a cloud dot. Directory publication is separate. |
| Grok Bot (`x.ai/bot`) | Add a custom remote MCP connector with the URL above using Grok Bot’s supported connection controls, then complete Strata OAuth. Use **Connect apps** for the marketplace plugin once published. | Custom OAuth and all six tools passed in Grok Bot on October 15. The marketplace application is submitted and awaiting review; this is not marketplace approval. |
| Other MCP hosts | Add the remote URL, select OAuth, and use discovered metadata. | Require secure token storage and a successful account call. |

### Directory availability

As of October 15, 2026, Muse’s native application and Grok Bot’s marketplace application are submitted and awaiting review. The Claude directory application remains a draft, although the custom connector completed OAuth and all six tool checks. OpenAI’s application remains a draft and its publisher-portal Connect flow has not completed authorization. Local Codex MCP access is separate from that portal. No directory listing is claimed approved or published. Use only installation controls actually available in the user's host.

### Grok Bot custom connection

Ask Grok Bot to add `https://stratatcg.com/connector/mcp` as a custom remote MCP connector with OAuth. Review the account and permissions on Strata before allowing access. The tested app used a `www.cursor.com` client identity; confirm the host initiated the flow rather than assuming a client label proves endorsement. After connecting, call `strata_account` and follow the one-time identify check below. If the installed version does not expose custom connectors, use the signed-in console until the marketplace listing becomes available.

### Codex

```sh
codex mcp add strata --url https://stratatcg.com/connector/mcp
codex mcp login strata
```

Keep an existing working Strata connection; inspect it before changing configuration. On hosts supporting explicit registration preference, CIMD is preferred; DCR is a compatibility fallback. Do not invent client IDs or callback URLs. If an older host cannot complete discovery, update it or use its documented bearer-token credential setting.

### Claude Code

```sh
claude mcp add --transport http --scope user strata https://stratatcg.com/connector/mcp
```

Then open `/mcp` in Claude Code and authenticate Strata. A project-scoped connection may be preferable for shared project configuration; credentials must remain in each user's private host store.

### Hermes

```sh
hermes mcp add --url https://stratatcg.com/connector/mcp --auth oauth strata
hermes mcp login strata
```

Reload MCP tools in an active session using the host's supported reload control.

### OpenClaw

```sh
openclaw mcp set strata '{"url":"https://stratatcg.com/connector/mcp","transport":"streamable-http","auth":"oauth"}'
openclaw mcp login strata
```

Consult the installed version's help before changing an existing configuration.

## API-key fallback

Use the existing [Strata account dashboard](https://stratatcg.com/connector/dashboard?from=agent) to create one personal API key for that agent. The user copies it directly into the host's private credential input as `STRATA_API_KEY`; never into chat, command arguments, repository configuration, shell history, logs, or a shared document. A plain configuration file is not a credential vault. A one-turn shell environment does not establish a persistent installation.

A host with a secure injected environment can use `Authorization: Bearer ${STRATA_API_KEY}` for this MCP endpoint or the personal-key REST API. For Codex, the supported environment reference is configured without embedding a secret:

```sh
codex mcp add strata --url https://stratatcg.com/connector/mcp --bearer-token-env-var STRATA_API_KEY
```

Use this alternative only after the host's secret manager supplies the variable to the actual agent process, including future sessions. OAuth is easier for local clients because the host manages token persistence. If secure credential storage or API execution is unavailable, use the [console](https://stratatcg.com/connector/console) and say that a native installation has not occurred. Never extract browser cookies to bypass account linking.

## Verify and begin

Call `strata_account` first, confirm the intended existing account and current allowance, then make one `strata_identify` call:

```json
{
  "operationKey": "strata-setup-charizard-REPLACE-WITH-ONE-UUID",
  "input": {
    "text": "Charizard ex 199/165 151",
    "hints": {"game": "Pokemon"},
    "enrich": false
  }
}
```

Generate the UUID once and retain the exact arguments for network retries. The `operationKey` becomes the existing `Idempotency-Key` header; do not regenerate it after a timeout. Confirm the returned confident identity is Charizard ex 199/165, SV: Scarlet & Violet 151 (TCGplayer 517045). This uses one credit for a successful identity, with no pricing. Then ask what the user wants to identify or price. Do not repeat the lookup on every reconnect.

After this explicit identity-only setup check, ordinary product lookups should identify and price together: set `input.enrich:true` for `strata_identify` or `strata_slabs` unless the user asks otherwise. Reuse returned pricing. Include the established TCGplayer product link and returned card images when supported; follow [result presentation](./agent-workflows.md) for exact fields, slab mapping limits and batch layout.

The tools are `strata_account`, `strata_identify`, `strata_enrich`, `strata_slabs`, `strata_graded`, and `strata_product`. Discover their schemas through MCP. REST schemas remain in [OpenAPI](https://stratatcg.com/connector/openapi.json). The four lookup tools require an operation key. Account and registry reads do not consume lookup credits. MCP does not expose suggestions, feedback, purchase, plan-change, or administrative tools.

MCP requests, including initialization and tool listing, require authentication. A missing or expired token returns HTTP 401 with a `WWW-Authenticate` resource-metadata challenge so your host can start sign-in immediately. OAuth discovery metadata remains public.

The four lookup tools deliberately use `readOnlyHint: false` because they consume lookup allowance and record the idempotent operation. They cannot purchase anything, change a plan, or modify a collection. Hosts may request confirmation before these metered actions. Account and registry reads use `readOnlyHint: true`; all six tools use `destructiveHint: false`.

Read images locally with your own image tools and send only relevant text. Confirm ambiguous printing selections. Use the official registry for verified raw/graded links; proposed links are not verified. Missing prices are unavailable, never zero. Preserve currency, source and observation time. Read the [complete workflow guide](./agent-workflows.md).

## Authentication and lifetime

The protected resource and OAuth issuer are both `https://stratatcg.com/connector/mcp`. Resource metadata is at `https://stratatcg.com/.well-known/oauth-protected-resource/connector/mcp`; authorization-server metadata is at `https://stratatcg.com/.well-known/oauth-authorization-server/connector/mcp`. Require `resource` in authorization and code exchange. Tokens are audience-bound to MCP and cannot be used at the separate Muse sandbox or legacy JSON gateway.

Clients request only `account:read cards:read`. Tools publish OAuth scope metadata and reconnect challenges. Access tokens last 15 minutes; refresh tokens rotate within a 90-day grant. Reusing a rotated refresh token revokes its family. Keep token refresh serialized per connection. Personal API keys expire separately after 90 days.

CIMD fetches require HTTPS, public DNS destinations, a direct JSON response, matching `client_id`, and bounded payloads. Exact HTTPS callbacks and native loopback callbacks are supported. Only the port can vary for a loopback registration without a fixed port. Dynamic clients are labelled unverified at consent; registration is not endorsement.

## Billing and recovery

Use `strata_account` before suggesting payment, then the existing [billing dashboard](https://stratatcg.com/connector/dashboard#billing). Retain task context while the user reviews payment. Never buy or change a plan without approval. After payment, re-read account allowance and resume unfinished work; a redirect alone does not prove payment. Honor `Retry-After`; a provider outage is not fixed by upgrading.

Revoke access in the dashboard and remove the host connection when disconnecting. Disconnecting an agent does not cancel a subscription. Cancel billing separately if the user requests it.

## Host references

Installation interfaces vary by version. References checked October 14, 2026: [Codex MCP](https://learn.chatgpt.com/docs/extend/mcp?surface=cli), [Claude Code MCP](https://code.claude.com/docs/en/mcp), [Hermes MCP](https://hermes-agent.nousresearch.com/docs/user-guide/features/mcp), [OpenClaw transports](https://docs.openclaw.ai/cli/mcp/transports), [OpenAI plugin packaging](https://developers.openai.com/plugins/build/plugins), [dots and apps](https://learn.chatgpt.com/docs/dots/computers-and-apps), and [Grok Bot apps](https://docs.x.ai/grok-bot/computer-and-apps).