MCP server

Connect an AI assistant to a Tanqory store

The Tanqory MCP server gives Claude, ChatGPT or any MCP client a store's orders, products, customers and reports, through the merchant's own sign-in. Reads answer at once; every change shows a preview and waits for a yes.

Connect a client See the 31 tools

pampa: zsh

sofia@pampa ~ % curl -s https://api.tanqory.com/v1/mcp/health | jq '{status, service}'{  "status": "ok",  "service": "mcp-gateway"}sofia@pampa ~ % curl -s https://api.tanqory.com/.well-known/oauth-protected-resource/v1/mcp | jq -r '.scopes_supported[]'tanqory.store.public.readtanqory.store.private.readtanqory.analytics.readtanqory.content.writetanqory.operations.writetanqory.storefront.writesofia@pampa ~ %

Connect

Paste one URL into the assistant

A client that speaks MCP over Streamable HTTP needs only https://api.tanqory.com/v1/mcp. It reads /.well-known/oauth-protected-resource to find the sign-in, and the merchant decides what it may do. Menu names below are the hosts' own and can move.

ClaudeSettings, Connectors, Add custom connector: paste the URL and choose Connect. Tanqory's sign-in opens, the merchant approves the scopes and the tools appear in the chat.
ChatGPTSettings, Connectors, developer mode, then add an MCP server with the same URL. Which plans and workspaces offer developer mode is ChatGPT's choice. The same sign-in and scope screen follow.
Your own clientGet a token through the OAuth flow under Sign-in, then POST one JSON-RPC message per request with it as a bearer token. There is no session to open and no stream to hold.

Claude: Add custom connector

Name   TanqoryURL    https://api.tanqory.com/v1/mcpConnect  -> accounts.tanqory.com:     the merchant signs in  -> approve the scopes asked for  -> the granted tools appear

Sign-in

OAuth with discovery, so no key is ever pasted

The client reads the server's protected resource metadata, registers itself with the authorization server and sends the merchant to Tanqory's sign-in with PKCE. The token it gets back works for one store.

Protected resource metadatanames the resource, the authorization server accounts.tanqory.com, the six scopes and the header the token goes in.
Client registrationis dynamic, at api.tanqory.com/api/oauth/register, so there is no app to create first. Public clients use PKCE with S256; a server client may use client_secret_post.
One store per tokenThe store comes from the token itself. No tool takes a store id, and a token for one store cannot reach another.

accounts.tanqory.com/.well-known/oauth-authorization-server

{  "issuer": "https://accounts.tanqory.com",  "authorization_endpoint": "https://api.tanqory.com/api/oauth/authorize",  "token_endpoint": "https://api.tanqory.com/api/oauth/token",  "revocation_endpoint": "https://api.tanqory.com/api/oauth/revoke",  "registration_endpoint": "https://api.tanqory.com/api/oauth/register",  "jwks_uri": "https://api.tanqory.com/api/auth/.well-known/jwks.json",  "response_types_supported": ["code"],  "grant_types_supported": ["authorization_code", "refresh_token"],  "code_challenge_methods_supported": ["S256"],  "token_endpoint_auth_methods_supported": ["none", "client_secret_post"]}

Scopes

Six scopes, and the client sees only what the merchant grants

tools/list returns only the tools the merchant's consent covers. Read scopes answer at once; the three write scopes add tools that preview before they save.

Readtanqory.store.private.read opens orders, products, customers and the rest of the store's records; tanqory.analytics.read adds sales and traffic reports; tanqory.store.public.read reaches Tanqory's help articles only, with no store data.
Writetanqory.content.write covers products, collections, discounts, gift cards, content and media; tanqory.operations.write covers orders, draft orders, returns, inventory, purchasing, customers, companies, staff, marketing, theme, domains, markets, subscriptions and settings.
Storefronttanqory.storefront.write is a scope of its own for the website builder, so an assistant trusted to fix product titles cannot also rebuild the store's site.

scopes and the tools they add

tanqory.store.public.read  help articles only, no store datatanqory.store.private.read  query, gettanqory.analytics.read  analyticstanqory.content.write  products, collections, discounts,  gift_cards, content, mediatanqory.operations.write  orders, draft_orders, returns,  inventory, purchasing, customers,  companies, staff, marketing, theme,  domains, markets, subscriptions,  settingstanqory.storefront.write  storefront

Tools

31 tools, each behind a scope

24 capability tools each take one action or dataset name plus an input, so a client loads a short list instead of hundreds of narrow tools. Seven more search help, describe fields and launch a new store.

query and getfind records by dataset, such as orders, inventory or store_readiness, or open one record by id. Read results carry a dashboardUrl to the same record in the dashboard.
search_toolsfinds the right tool for a task written in plain words, so the assistant does not have to guess from names.
describe_toolreturns the exact fields an action or dataset takes, before the first call. Every tool also ships an input and an output schema.

tools/list

# 24 capability toolsquery                  Find store recordsget                    Open one recordanalytics              Sales and traffic reportsproducts               Products and variantscollections            Collectionsinventory              Inventory and stock transferspurchasing             Purchase orders and suppliersorders                 Orders and fulfilmentdraft_orders           Draft orders and quotesreturns                Returns and exchangescustomers              Customers and segmentscompanies              B2B companiesstaff                  Staff and rolesdiscounts              Discounts and offersgift_cards             Gift cardsmarketing              Email campaigns and automationscontent                Pages, blogs and custom datamedia                  Media librarystorefront             Website buildertheme                  Themes and storefront accessdomains                Domainsmarkets                Markets and catalogssubscriptions          Subscriptions and selling planssettings               Store settings# 7 moresearch_help_center     Search Tanqory help articlesask_tanqory_help       Ask Tanqory helpsearch_tools           Find what the store can dodescribe_tool          Describe a tool's fieldslaunch_store           Launch the storeget_store_launch       Store launch statuscontinue_store_launch  Resume the store launch

Changes ask first

Every change shows a preview before it saves

A write never saves on its first call. It returns what would change and a confirmationToken that lasts five minutes; the assistant shows the preview to the merchant and calls again with confirm set to true and the token.

PreviewThe first call returns phase preview and saved false, with a preview and any warning in the merchant's terms.
ConfirmCall again with identical input, confirm: true and the confirmationToken. Phase becomes confirmed and saved becomes true. The token works once, for that input only; a late one fails with confirmation_expired and nothing is saved.
Higher-risk actionssuch as deleting a discount also return a requiredAcknowledgment phrase for the merchant to type. The confirm call sends it back as acknowledgmentPhrase with acknowledgedRisk: true; a plain yes is not enough.

activate-discount.http

POST /v1/mcp HTTP/1.1Host: api.tanqory.comAuthorization: Bearer <access token>Content-Type: application/json{"jsonrpc": "2.0", "id": 7, "method": "tools/call", "params": {"name": "discounts", "arguments": {   "action": "activate", "input": {"code": "MATE15"}}}}# result: phase "preview", saved false,# a preview, a confirmationToken and# expiresIn 300 (seconds). Nothing# has changed yet.{"jsonrpc": "2.0", "id": 8, "method": "tools/call", "params": {"name": "discounts", "arguments": {   "action": "activate", "input": {"code": "MATE15"},   "confirm": true, "confirmationToken": "<from the preview>"}}}# result: phase "confirmed", saved true.

Protocol

Plain JSON-RPC over HTTPS

The server speaks MCP 2025-06-18 over Streamable HTTP without sessions or a server stream. Each POST carries the bearer token and one JSON-RPC message, and gets one answer.

Methodsinitialize, tools/list, tools/call, resources/list and resources/read. The resources are approval cards a host can draw next to a preview.
NotificationsA message without an id gets 202 and an empty body.
HealthGET /api/mcp/health answers without a token, for uptime checks.

initialize.http

POST /v1/mcp HTTP/1.1Host: api.tanqory.comAuthorization: Bearer <access token>Content-Type: application/json{"jsonrpc": "2.0", "id": 1, "method": "initialize", "params": {"protocolVersion": "2025-06-18", "capabilities": {},   "clientInfo": {"name": "pampa-reports", "version": "1.0.0"}}}HTTP/1.1 200 OKContent-Type: application/json{"jsonrpc": "2.0", "id": 1, "result": {  "protocolVersion": "2025-06-18",  "serverInfo": {"name": "tanqory", "title": "Tanqory", "version": "1.0.0"},  "capabilities": {"tools": {},    "resources": {"subscribe": false, "listChanged": false}},  "instructions": "Tanqory is the merchant's own ..."}}

Try it on a store you own

Open a store, point your client at https://api.tanqory.com/v1/mcp, sign in and call tools/list. The same store data is also on the REST APIs in the API reference.

MCP 2025-06-18 over Streamable HTTP
OAuth with PKCE and dynamic registration
Writes preview first, then confirm

Open a store API reference