# MCP Integration

The Tesser MCP server exposes every public API endpoint as a tool that AI agents can discover and invoke. It uses **Streamable HTTP** transport at:

```
https://sandbox.tesserx.co/v1/mcp
```

Authentication uses the same Auth0 credentials as the REST API, in one of two ways:

- **OAuth discovery (recommended)** — the server advertises OAuth metadata, so clients that support the [MCP authorization spec](https://modelcontextprotocol.io/specification/draft/basic/authorization) (e.g. Cursor) run the OAuth flow and refresh tokens for you. See [OAuth discovery](#oauth-discovery).
- **Manual bearer token** — a fallback for clients without OAuth discovery (e.g. Claude Code today). You fetch a token and set it as a header. See [Manual token](#manual-token).

## OAuth discovery

The MCP endpoint serves [RFC 9728](https://datatracker.ietf.org/doc/html/rfc9728) metadata at `/.well-known/oauth-protected-resource`, pointing clients at our Auth0 server. A `401` also returns a `WWW-Authenticate: resource_metadata` hint, so a compliant client discovers everything with no extra config.

### Cursor — `.cursor/mcp.json`

```jsonc
{
  "mcpServers": {
    "tesser-payments": {
      "url": "https://sandbox.tesserx.co/v1/mcp",
      "auth": {
        "CLIENT_ID": "${env:TESSER_API_KEY}",
        "CLIENT_SECRET": "${env:TESSER_API_SECRET}"
      }
    }
  }
}
```

Cursor runs the OAuth flow on first use and refreshes tokens automatically.

## Manual token

For clients without OAuth discovery, fetch a token and pass it as a header. Set it in the shell before launching your IDE:

```bash
export MCP_TOKEN=$(bash scripts/mcp-token.sh)
```

### Claude Code — `.claude/settings.local.json`

```jsonc
{
  "mcpServers": {
    "tesser-payments": {
      "type": "url",
      "url": "https://sandbox.tesserx.co/v1/mcp",
      "headers": {
        "Authorization": "Bearer ${MCP_TOKEN}"
      }
    }
  }
}
```

Run `/mcp` in Claude Code to reload.

### Cursor — `.cursor/mcp.json`

```jsonc
{
  "mcpServers": {
    "tesser-payments": {
      "type": "url",
      "url": "https://sandbox.tesserx.co/v1/mcp",
      "headers": {
        "Authorization": "Bearer ${MCP_TOKEN}"
      }
    }
  }
}
```

Restart Cursor. (Prefer [OAuth discovery](#oauth-discovery), which refreshes tokens for you.)

### Windsurf — `.windsurf/mcp.json`

```jsonc
{
  "mcpServers": {
    "tesser-payments": {
      "type": "url",
      "url": "https://sandbox.tesserx.co/v1/mcp",
      "headers": {
        "Authorization": "Bearer ${MCP_TOKEN}"
      }
    }
  }
}
```

Restart Windsurf.

### Token refresh

Manual tokens expire after ~24h; calls then fail with `401`. Re-run the `export` above and restart your IDE (or `/mcp` in Claude Code). See [Manual MCP Setup](/agentic/manual-mcp) for details, or use [OAuth discovery](#oauth-discovery) to avoid refreshing.