Skip to content

New paid orders and subscriptions are retired. Existing records, settlement and refunds remain available through your account.

Connect an MCP client: current transport limits

The HTTPS gate is custom JSON-RPC; the stdio bridge is not publicly distributed yet.

Cambridge TCG accepts one JSON-RPC request per HTTPS POST at /api/mcp, but that endpoint is not MCP Streamable HTTP or HTTP+SSE. Native MCP clients would need the stdio bridge in packages/mcp-server, which is not publicly distributed yet: the source repository is private and @cambridge-tcg/mcp-server is not on npm (404, rechecked 2026-10-10). Until the source is released, use a client that can POST JSON-RPC 2.0 to /api/mcp, or call the public REST routes directly.

10 min· 3 steps· last verified 2026-07-12· revised 2026-10-10

Steps revised after the last walk-through; the revised steps have not been walked through yet.

Prerequisites

  • • An HTTP client that can send JSON-RPC 2.0 POST requests, or an MCP client that supports a custom JSON-RPC HTTP endpoint
  • • Optional: a Cambridge TCG account to provision a bearer token at /account/agents

Steps

  1. 1

    Read the connection facts

    Fetch the discovery document. It names the custom HTTPS transport, the absence of Streamable HTTP and SSE, the vendored bridge, and a list of no-auth direct-API tools.

    Run this

    curl https://cambridgetcg.com/.well-known/mcp-config.json

    Expected response shape

    { "remote_json_rpc_endpoint": { "cambridge-tcg": { "url": "...", "transport": "custom-json-rpc-over-https-post", "mcp_streamable_http": false } }, "stdio_bridge": { "status": "vendored-in-repository", "npm_published": false, ... }, "no_auth_alternative_tools": [{ "tool_name": "ctcg_get_card", "url_template": "...", ... }], "recommended_user_agent": "...", "first_request_guide": "..." }

    What to do with it

    Use direct REST endpoints for public structural reads. Continue only when your MCP client needs the typed tool palette or authenticated agent-owned reads.

  2. 2

    Call the gate directly

    Send JSON-RPC 2.0 requests to https://cambridgetcg.com/api/mcp. initialize and tools/list are public; other tool calls need a bearer token. Do not use npx @cambridge-tcg/mcp-server: the package is not on npm, and the stdio bridge cannot be built outside the private repository yet.

    Run this

    curl -s https://cambridgetcg.com/api/mcp \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

    What to do with it

    The response lists the tools and their input schemas. Authenticated calls add an Authorization: Bearer header; see step 3.

  3. 3

    Provision a bearer token (optional — for authenticated tools)

    If you want authenticated tools for your own agent or portfolio operations, a signed-in human can provision an operator-managed key at /account/agents. New self-serve registration is paused; existing self-serve keys remain read-only. Send the token as Authorization: Bearer <token> on each authenticated request.

    What to do with it

    Test with agent.self. Account identifiers stay internal; the response states whether the key is operator-bound and whether it is read-only.

Common gotchas

  • A remote MCP URL setting will not work

    The HTTPS gate accepts MCP-shaped methods but does not implement MCP Streamable HTTP or HTTP+SSE. Use a custom ordinary-HTTP JSON-RPC client; the stdio bridge is not publicly distributed yet.

  • Set User-Agent in MCP server config too

    Even when going through the MCP gate, our backend reads the User-Agent as ordinary request metadata. A contact in it is voluntary and does not create a promise of outreach. Do not put secrets or personal data in the header.

  • Bearer tokens do not have an automatic expiry

    Current agent keys remain valid until revoked or their agent is suspended or archived. Operator-managed keys can be revoked at /account/agents; existing self-serve keys do not yet have a holder-authenticated revocation path.

  • Public and bearer limits differ

    Bearer tools enforce per-key tiers. Public endpoints publish advisory freshness and crawl guidance, but do not currently share one uniform per-endpoint edge quota.

Next guide

Build a Discord bot using Cambridge TCG data →

Slash command → keyed structural lookup → honest embed.

See also