Connect an AI assistant | Stockisto Docs

Stockisto runs an MCP server so an AI assistant can find shops selling a product and, after sign-in, read or update your own account.

01 Two endpoints

Endpoint	Who	Sign-in	Limit
`/mcp`	Anyone	None	80 calls a minute per IP address
`/mcp/me`	Brand, retailer and installer staff	Your Stockisto sign-in, through OAuth	120 calls a minute per user

Both use Streamable HTTP. These URLs are on TEST:

URLs · TEST

https://api.test.stockisto.com/mcp
https://api.test.stockisto.com/mcp/me

The production host comes at go-live.

02 Connect your assistant

Assistant	Steps
Claude.ai	Open Settings, Connectors, Add custom connector. Paste the `/mcp/me` URL, choose Connect, sign in and choose Allow.
ChatGPT	In connector settings, enable developer mode before adding a custom connector. Paste the `/mcp/me` URL, connect, sign in and allow access.
Claude Code	Run the command below. Complete sign-in and consent in the browser.
Cursor	Add the server to `mcp.json` as below, reload and choose Connect in the MCP panel. Sign in and allow access.

Shell · Claude Code

claude mcp add --transport http stockisto https://api.test.stockisto.com/mcp/me

JSON · Cursor mcp.json

{
    "mcpServers": {
        "stockisto": {
            "url": "https://api.test.stockisto.com/mcp/me"
        }
    }
}

Each assistant registers itself, so the consent screen marks it as unverified. Check the assistant name, redirect host, your name and your company before allowing access. Read-only (mcp:read) is the default. Read and write (mcp:write) is a separate choice; write tools appear only with that consent.

03 Tools for everyone

find_where_to_buy finds shops for a product or brand in Sweden, Norway, Denmark and Finland. It accepts q (product name, article number, EAN or brand), category, city, country, latitude, longitude, radiusKm (up to 500), inStockOnly and a page number. It returns 12 shops per page with the stock signal, evidence and observation date.

04 Tools after sign-in

The tools follow your role and consent. A brand session never lists a retailer's tools. Start with read-only access and call supplier_list_retailers with a supplier account to check your own network.

Role	Read	Write
Brand	`supplier_search_products` `supplier_list_stock` `supplier_list_retailers` `supplier_get_retailer` `supplier_get_funnel` `supplier_get_widget_report` `supplier_get_attribution_baseline` `supplier_get_outreach_draft`	`supplier_save_outreach_draft`
Retailer	`retailer_list_store_questions` `retailer_get_store_question` `retailer_list_store_reviews` `retailer_get_store_review` `retailer_list_locations`	`retailer_update_stock` `retailer_confirm_stock`
Installer	`installer_get_my_company` `installer_list_reviews` `installer_list_job_requests` `installer_list_leads` `installer_get_lead_responsiveness`	`installer_submit_quote`

supplier_get_widget_report reads your own widget activity, with date, SKU, store, domain and device filters. The default period is 30 days; tagged bots are excluded unless includeBots is true.

Saving an outreach draft requires a SupplierAdmin account and the ai-recommendations feature. It saves a draft; it does not send a message. A feature refusal is resolved through feature access, not by granting consent again. Installer tools require an approved company. Stockisto operator tools are excluded from customer connections.

Write tools require an idempotencyKey. Repeating the same key and arguments returns the first result with replayed: true; changed arguments with the same key return idempotency_key_reused. Review the target and proposed change before calling a write tool.

05 Remove access

Open Connected assistants in your portal: brand, retailer or installer. Remove the assistant's grant. Its next refresh fails; an issued access token can remain valid until its own expiry. Logout, password changes and session invalidation can end access earlier. If the connection stops working, sign in again and reconnect with the intended account and scope.

06 For your own MCP client

Step	Endpoint or requirement
Discovery	OAuth protected-resource metadata (RFC 9728) and authorization-server metadata (RFC 8414), served by the API
Register	`POST /oauth/register`, dynamic client registration
Authorize	PKCE with S256 only
Token	`POST /oauth/token`; refresh tokens rotate on use and reuse ends the grant
Revoke	`POST /oauth/revoke`

An internal hostname in discovery or consent settings is a server configuration error. Ask your Stockisto operator to check the public API origin.

See Settings for account preferences.

For the public API, see Developer reference. Recent changes are in the Changelog.