{
  "markdown": "# Presscart MCP\n\nThe official [Model Context Protocol](https://modelcontextprotocol.io) server for [Presscart](https://www.presscart.com), a marketplace for disclosed paid editorial placements across 1,700+ publications. It lets AI assistants and agents browse the outlet catalog, manage campaigns and orders, and track article status through the [Presscart API](https://docs.presscart.com).\n\nHosted endpoint: `https://mcp.presscart.com/mcp` — see [Client Setup](#client-setup) for connecting from Claude, Cursor, VS Code, ChatGPT, and other MCP clients. A Presscart account is required.\n\nSupports:\n- hosted Streamable HTTP mode\n\nHosted HTTP mode supports two auth models:\n- MCP OAuth mode: Supabase/Auth issues the OAuth token, and clients connect to `/mcp` with `Authorization: Bearer <oauth_access_token>`.\n- Legacy direct-token mode: the caller provides a Presscart API token via `X-Presscart-API-Token`, and the server uses that token as the upstream Presscart credential.\n\n## Environment\n\nRequired:\n\n```bash\nexport PRESSCART_API_URL=\"http://api.presscart.com/\"\n```\n\nOptional app link settings:\n\n```bash\nexport PRESSCART_APP_URL=\"https://app.presscart.com\"\n```\n\nOptional hosted mode settings:\n\n```bash\nexport MCP_HOST=\"0.0.0.0\"\nexport MCP_PORT=\"8787\"\nexport MCP_SERVER_URL=\"https://mcp.presscart.com/mcp\"\nexport MCP_SESSION_IDLE_TTL_MS=\"43200000\"\n```\n\nOptional host/origin overrides for reverse proxies or multiple domains:\n\n```bash\nexport MCP_ALLOWED_HOSTS=\"mcp.presscart.com\"\nexport MCP_ALLOWED_ORIGINS=\"https://mcp.presscart.com,https://claude.ai,https://claude.com\"\n```\n\nWhen `MCP_ALLOWED_ORIGINS` is not set, hosted mode allows the configured MCP server origin plus Claude's remote connector origins.\n\nOptional OAuth settings:\n\n```bash\nexport MCP_OAUTH_ENABLED=\"true\"\nexport MCP_OAUTH_ISSUER_URL=\"https://<project-ref>.supabase.co/auth/v1\"\nexport MCP_OAUTH_AUDIENCE=\"https://mcp.presscart.com/mcp\"\nexport MCP_OAUTH_TRANSLATOR_ENABLED=\"false\"\nexport MCP_OAUTH_LEGACY_AUDIENCE=\"https://mcp.presscart.com\"\nexport MCP_OAUTH_UPSTREAM_TIMEOUT_MS=\"10000\"\n```\n\nNotes:\n- `PRESSCART_API_URL` must point at the app API base that exposes `/teams/*` routes, not a public-api-only base.\n- `PRESSCART_APP_URL` controls direct application links returned by tools such as `list_publisher_articles`. Set it per environment so staging MCP links open staging.\n- Tools that create orders/campaigns or read profile orders need an explicit `profile_id`. If the profile is unknown, call `list_teams`, then `list_profiles`.\n- In MCP OAuth mode, the app's Supabase OAuth Server handles authorization and consent. This MCP runtime validates the issued access token against Supabase JWKS and delegated permissions.\n- `MCP_OAUTH_TRANSLATOR_ENABLED` defaults to `false`. When enabled, the MCP origin publishes a standards-based OAuth facade while Supabase remains responsible for clients, codes, tokens, rotation, signing, and consent.\n- `MCP_OAUTH_ISSUER_URL` must use HTTPS. Loopback HTTP issuers are accepted only for local development.\n- `MCP_OAUTH_LEGACY_AUDIENCE` is an optional verifier-only migration value and must equal the configured MCP server origin (for example, `https://mcp.presscart.com`). It cannot duplicate the canonical `/mcp` resource or name another service, and it never changes the protected resource advertised to clients.\n- MCP clients store their own refresh tokens, initiate refresh automatically, and replace rotated refresh and access tokens. This server handles the refresh request statelessly and does not store refresh tokens.\n- The translator changes only MCP OAuth. It does not change ordinary Presscart browser or app sessions, and disabling MCP OAuth still preserves legacy direct-token mode.\n- In legacy direct-token mode, send `X-Presscart-API-Token: <presscart_api_token>` on `initialize` and later requests that need to confirm the active session credential.\n\n## Install\n\n```bash\ncd presscart-mcp\nnpm install\n```\n\n## Run\n\nDevelopment:\n\n```bash\nnpm run dev:http\n```\n\nBuild and run:\n\n```bash\nnpm run build\nnpm start\n```\n\nBuild and run hosted HTTP:\n\n```bash\nnpm run build\nnpm run start:http\n```\n\n## Release\n\nReleases are automated by semantic-release from Conventional Commits.\n\n- `fix:` creates a patch release.\n- `feat:` creates a minor release.\n- `!` or `BREAKING CHANGE:` creates a major release.\n- `docs:`, `test:`, `chore:`, and other non-release commits do not publish a new version by default.\n\nThe `Release` workflow runs on pushes to `main` and `staging`. It runs check, test, and build, then semantic-release creates the release tag and publishes the GitHub release.\n\n- `main` publishes stable releases and commits generated release files: `CHANGELOG.md`, `package.json`, `package-lock.json`, and `src/version.ts`.\n- `staging` publishes release candidates with the `rc` prerelease channel, but does not commit generated release files. This keeps staging-to-main promotion merges from conflicting on prerelease metadata.\n\nYou can dry-run the release locally:\n\n```bash\nnpm run release:dry-run\nnpm run release:staging:dry-run\n```\n\nIf the repository has no existing release tag yet, create the baseline tag before the first semantic-release run so the next release continues from the current version:\n\n```bash\ngit tag v0.2.0\ngit push origin v0.2.0\n```\n\n## Tools\n\n- `get_user`\n- `list_teams`\n- `get_team`\n- `list_profiles`\n- `upload_files`\n- `list_outlets`\n- `get_outlet`\n- `create_outlet`\n- `update_outlet`\n- `list_outlet_channels`\n- `create_outlet_channel`\n- `update_outlet_channel`\n- `delete_outlet_channel`\n- `list_product_types`\n- `list_product_listings`\n- `list_countries`\n- `list_states`\n- `list_cities`\n- `get_product_listing`\n- `list_products`\n- `get_product`\n- `create_product`\n- `update_product`\n- `create_order`\n- `get_order`\n- `list_order_items`\n- `list_profile_orders`\n- `create_campaign`\n- `list_campaigns`\n- `get_campaign`\n- `update_campaign`\n- `list_campaign_articles`\n- `list_publisher_articles`\n- `add_order_items_to_campaign`\n- `get_campaign_article_status`\n- `upload_campaign_questionnaire`\n- `upload_article`\n- `replace_article_file`\n- `submit_article`\n- `request_article_writing`\n\n## Hosted deployment shape\n\n### MCP OAuth mode\n\nEnable OAuth:\n\n```bash\nPRESSCART_API_URL=http://api.presscart.com/\nMCP_HOST=0.0.0.0\nMCP_PORT=8787\nMCP_SERVER_URL=https://mcp.presscart.com/mcp\nMCP_SESSION_IDLE_TTL_MS=43200000\nMCP_OAUTH_ENABLED=true\nMCP_OAUTH_ISSUER_URL=https://<project-ref>.supabase.co/auth/v1\nMCP_OAUTH_AUDIENCE=https://mcp.presscart.com/mcp\nMCP_OAUTH_TRANSLATOR_ENABLED=false\nMCP_OAUTH_LEGACY_AUDIENCE=https://mcp.presscart.com\nMCP_OAUTH_UPSTREAM_TIMEOUT_MS=10000\n```\n\nThe canonical resource and JWT audience must match `MCP_SERVER_URL`, allowing only a trailing-slash difference. Both public OAuth URLs and the upstream issuer must use HTTPS except for loopback-only local development. `MCP_OAUTH_LEGACY_AUDIENCE` is needed only during the migration window, must match the MCP server origin exactly, and should otherwise be unset.\n\nWith the translator disabled, the server exposes direct-Supabase protected-resource metadata at:\n\n- `/.well-known/oauth-protected-resource`\n- `/.well-known/oauth-protected-resource/mcp`\n\nWith the translator enabled, those routes advertise `https://mcp.presscart.com` as the authorization server, and the server also exposes:\n\n- `/.well-known/oauth-authorization-server`\n- `/oauth/authorize`\n- `/oauth/register`\n- `/oauth/token`\n\nThe facade accepts the standard authorization-code and refresh-token flows and proxies only to the configured Supabase issuer. It does not derive upstream targets from request hosts, forwarded headers, query parameters, or client-supplied URLs.\n\nThe facade does not expose or advertise an RFC token-revocation endpoint. Revocation stays in the existing Presscart app/admin flow: revoking the Presscart OAuth grant makes the next refresh fail. An access token that was already issued is not actively revoked by this MCP verifier and can remain cryptographically valid until its normal expiry. After it expires, the client cannot obtain a replacement, access ends, and the user must reauthorize.\n\nHosted MCP clients should connect to `https://mcp.presscart.com/mcp` and use normal MCP OAuth discovery. After the browser flow completes, they send `Authorization: Bearer <oauth_access_token>` to `/mcp`. Clients own refresh-token storage, automatically initiate refresh, and persist each rotated refresh token returned by Supabase through the facade.\n\nChatGPT, Claude, Cursor, and Codex consume the same MCP and OAuth standards. The server has no vendor-specific authentication branches. Labels and prompts such as **Connect** or **Authenticate** are controlled by each client platform, not by this server.\n\n### OAuth rollout and rollback\n\nDeploy the audience migration and translator in this order:\n\n1. Deploy this MCP server with `MCP_OAUTH_TRANSLATOR_ENABLED=false`, canonical `MCP_OAUTH_AUDIENCE=https://mcp.presscart.com/mcp`, and temporary `MCP_OAUTH_LEGACY_AUDIENCE=https://mcp.presscart.com` dual-audience verification.\n2. Deploy the Presscart app access-token hook so initial and refreshed MCP tokens use the canonical `/mcp` audience.\n3. Wait at least one full access-token lifetime, then confirm legacy-audience use has drained.\n4. Enable `MCP_OAUTH_TRANSLATOR_ENABLED=true` in non-production and run discovery, authorization-code, and refresh smoke tests. Revoke a Presscart OAuth grant through the existing app/admin flow and verify that the next refresh fails. Do not expect an already-issued access token to fail immediately: let it reach its normal expiry, then verify that the client cannot replace it and requires reauthorization before enabling the translator in production.\n5. Create and publish a replacement ChatGPT workspace app. Keep the old app available during the reconnection window.\n6. Verify ChatGPT, Claude, Cursor, and Codex before and after access-token expiry, then remove the old app and `MCP_OAUTH_LEGACY_AUDIENCE` only after telemetry confirms they are unused.\n\nTo roll back the facade, set `MCP_OAUTH_TRANSLATOR_ENABLED=false`; direct Supabase metadata returns without changing legacy direct-token MCP or ordinary Presscart sessions. Keep canonical audience issuance and temporary legacy verification in place until the rollback window is complete. Clients registered against the facade may need to reconnect through the direct Supabase flow.\n\n### Legacy direct-token mode\n\nIf `MCP_OAUTH_ENABLED` is unset or `false`, hosted clients can still connect to `/mcp` directly and provide the user's Presscart API token via `X-Presscart-API-Token`.\n\nFor Railway:\n\n```bash\nPRESSCART_API_URL=http://api.presscart.com/\nMCP_HOST=0.0.0.0\nMCP_PORT=8787\nMCP_SERVER_URL=https://mcp.presscart.com/mcp\n```\n\nStart command:\n\n```bash\nnpm run start:http\n```\n\nExample initialize request in legacy direct-token mode:\n\n```bash\ncurl -X POST https://mcp.presscart.com/mcp \\\n  -H 'Content-Type: application/json' \\\n  -H 'Accept: application/json, text/event-stream' \\\n  -H 'X-Presscart-API-Token: pc_...' \\\n  --data '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"initialize\",\"params\":{\"protocolVersion\":\"2025-06-18\",\"capabilities\":{},\"clientInfo\":{\"name\":\"example\",\"version\":\"1.0.0\"}}}'\n```\n\n## Client Setup\n\n### Claude and Claude Desktop\n\nRemote MCP servers for Claude and Claude Desktop are added in the product UI, not via `claude_desktop_config.json`.\n\n1. Open `Settings > Connectors`.\n2. Add a custom remote MCP connector.\n3. Enter your MCP server URL:\n\n```text\nhttps://mcp.presscart.com/mcp\n```\n\n4. Start the OAuth flow when prompted.\n5. Approve or deny the delegated access request in the Presscart consent UI.\n\n### Claude Code\n\nAdd the remote server from the CLI:\n\n```bash\nclaude mcp add --transport http presscart https://mcp.presscart.com/mcp\n```\n\nThen run Claude Code and use `/mcp` if it prompts you to complete OAuth authentication.\n\n### Codex\n\nAdd the remote server from the CLI:\n\n```bash\ncodex mcp add presscart --url https://mcp.presscart.com/mcp\ncodex mcp login presscart\n```\n\nCodex supports remote Streamable HTTP MCP servers with OAuth. The configured MCP URL and the `WWW-Authenticate` `resource_metadata` URL should both use the MCP public hostname. With `MCP_OAUTH_TRANSLATOR_ENABLED=true`, protected-resource metadata advertises the MCP-origin facade as its authorization server; with the translator disabled, it advertises the direct Supabase/Auth issuer.\n\nQuick verification:\n\n```bash\ncurl -i https://mcp.presscart.com/mcp\ncurl -s https://mcp.presscart.com/.well-known/oauth-protected-resource/mcp | jq\n```\n\n### Cursor\n\nAdd the server in `.cursor/mcp.json` for a project, or `~/.cursor/mcp.json` for your user profile:\n\n```json\n{\n  \"mcpServers\": {\n    \"presscart\": {\n      \"url\": \"https://mcp.presscart.com/mcp\"\n    }\n  }\n}\n```\n\nCursor supports OAuth for remote HTTP MCP servers. Once added, use Cursor’s MCP UI to connect/authenticate.\n\n### VS Code / GitHub Copilot Chat\n\nAdd the server in `.vscode/mcp.json` for a workspace, or in your user `mcp.json`:\n\n```json\n{\n  \"servers\": {\n    \"presscart\": {\n      \"type\": \"http\",\n      \"url\": \"https://mcp.presscart.com/mcp\"\n    }\n  }\n}\n```\n\nThen open Copilot Chat in Agent mode and complete the OAuth flow when VS Code prompts you.\n\n### GitHub Copilot Coding Agent on GitHub.com\n\nGitHub’s coding agent currently does not support remote MCP servers that use OAuth. If you need GitHub-hosted Copilot integration today, use the legacy direct-token mode instead of `MCP_OAUTH_ENABLED=true`, or use VS Code/Copilot Chat locally.\n\n### ChatGPT\n\nChatGPT uses remote MCP servers through Developer Mode and Apps settings rather than a local config file.\n\n1. Enable Developer Mode in ChatGPT.\n2. Go to `Settings > Apps` and create a new app for your remote MCP server.\n3. Enter:\n\n```text\nhttps://mcp.presscart.com/mcp\n```\n\n4. Choose OAuth as the authentication mechanism.\n5. Complete the OAuth flow and approve the delegated access request in Presscart.\n\nNotes:\n- ChatGPT currently supports remote servers only, not local MCP servers.\n- Business and Enterprise/Edu have the fullest MCP app support; availability differs by plan.\n",
  "bytes": 14090,
  "sha": "9e0e0229b753f5da65c71c91cffa37c4acf5731386e1a28da225de93f5867f8f",
  "repo_slug": "presscart/presscart-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_com_presscart_presscart_e92703ed/readme"
}