curl --request POST \
--url https://app.stockshift.io/mcp \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"jsonrpc": "2.0",
"method": "<string>"
}
'import requests
url = "https://app.stockshift.io/mcp"
payload = {
"jsonrpc": "2.0",
"method": "<string>"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://app.stockshift.io/mcp",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'jsonrpc' => '2.0',
'method' => '<string>'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://app.stockshift.io/mcp"
payload := strings.NewReader("{\n \"jsonrpc\": \"2.0\",\n \"method\": \"<string>\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}{
"jsonrpc": "2.0",
"method": "<string>",
"id": "<unknown>",
"params": {}
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"code": "<string>",
"detail": "<string>",
"errors": {},
"feature": "<string>",
"reason": "<string>",
"attempts_left": 123,
"rule_ids": [
"<string>"
],
"witness": "<string>",
"blind_recount": true,
"flags": [
{
"flag": "<string>",
"facts": {},
"choices": [
"<string>"
]
}
]
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"code": "<string>",
"detail": "<string>",
"errors": {},
"feature": "<string>",
"reason": "<string>",
"attempts_left": 123,
"rule_ids": [
"<string>"
],
"witness": "<string>",
"blind_recount": true,
"flags": [
{
"flag": "<string>",
"facts": {},
"choices": [
"<string>"
]
}
]
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"code": "<string>",
"detail": "<string>",
"errors": {},
"feature": "<string>",
"reason": "<string>",
"attempts_left": 123,
"rule_ids": [
"<string>"
],
"witness": "<string>",
"blind_recount": true,
"flags": [
{
"flag": "<string>",
"facts": {},
"choices": [
"<string>"
]
}
]
}Call the MCP server
Point an MCP client, such as an AI assistant, at this address and it can work in StockShift over Streamable HTTP. The client signs in with OAuth (the oauth2 scheme) and every tool runs as the member who connected it, with only the scopes they approved. A tool does exactly what the same button in the app does, so permissions, plan limits and the audit trail apply as they would to the member. A failure comes back as a tool error with the same problem details this API sends. The organization’s plan must include the developer.mcp feature. Call tools/list to see what the member may use; these are all the tools the server has.
| Tool | What it does |
|---|---|
catalog_show_item | Look up an item |
insights_run_saved_report | Run a report |
inventory_change_stock_status | Change the status of stock |
inventory_create_stock_transfer | Create a stock transfer |
inventory_show_stock | Look up stock levels |
manufacturing_release_build | Release a build |
manufacturing_show_build | Look up a build |
purchasing_create_purchase_order | Create a purchase order |
purchasing_send_purchase_order | Send a purchase order to the supplier |
purchasing_show_purchase_order | Look up a purchase order |
sales_confirm_sales_order | Confirm a sales order |
sales_reserve_sales_order | Reserve stock for a sales order |
sales_send_invoice | Email an invoice to the customer |
sales_show_sales_order | Look up a sales order |
curl --request POST \
--url https://app.stockshift.io/mcp \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"jsonrpc": "2.0",
"method": "<string>"
}
'import requests
url = "https://app.stockshift.io/mcp"
payload = {
"jsonrpc": "2.0",
"method": "<string>"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://app.stockshift.io/mcp",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'jsonrpc' => '2.0',
'method' => '<string>'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://app.stockshift.io/mcp"
payload := strings.NewReader("{\n \"jsonrpc\": \"2.0\",\n \"method\": \"<string>\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}{
"jsonrpc": "2.0",
"method": "<string>",
"id": "<unknown>",
"params": {}
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"code": "<string>",
"detail": "<string>",
"errors": {},
"feature": "<string>",
"reason": "<string>",
"attempts_left": 123,
"rule_ids": [
"<string>"
],
"witness": "<string>",
"blind_recount": true,
"flags": [
{
"flag": "<string>",
"facts": {},
"choices": [
"<string>"
]
}
]
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"code": "<string>",
"detail": "<string>",
"errors": {},
"feature": "<string>",
"reason": "<string>",
"attempts_left": 123,
"rule_ids": [
"<string>"
],
"witness": "<string>",
"blind_recount": true,
"flags": [
{
"flag": "<string>",
"facts": {},
"choices": [
"<string>"
]
}
]
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"code": "<string>",
"detail": "<string>",
"errors": {},
"feature": "<string>",
"reason": "<string>",
"attempts_left": 123,
"rule_ids": [
"<string>"
],
"witness": "<string>",
"blind_recount": true,
"flags": [
{
"flag": "<string>",
"facts": {},
"choices": [
"<string>"
]
}
]
}Authorizations
For apps that other people connect to their StockShift account. Use the OAuth 2.1 authorization code flow with PKCE (S256); there is no client secret. Discover the endpoints at /.well-known/oauth-authorization-server (RFC 8414) and register your app at POST /oauth/register (RFC 7591). The member chooses the organization and approves the scopes on the consent page, and the token can never do more than the member could. Send it as Authorization: Bearer <token>, as you would an API key. Access tokens last an hour; each refresh returns a new refresh token, so store it.
Body
Response
The JSON-RPC answer, as JSON or as a server-sent event stream.
Was this page helpful?