# ClientProof MCP

> Read-only JSON-RPC tools over HTTPS for agency workspaces — collection links, testimonial queues, and Wall of Love embed snippets.

## Transport

- Catalog: `GET https://useclientproof.com/api/mcp` (Streamable HTTP; optional authenticated SSE on GET)
- Calls: `POST https://useclientproof.com/api/mcp` with `Authorization: Bearer cp_mcp_…` (or studio session cookie)
- Protocol: JSON-RPC 2.0 methods `initialize`, `tools/list`, and `tools/call`
- Protected resource metadata: https://useclientproof.com/.well-known/oauth-protected-resource
- Draft server card: https://useclientproof.com/.well-known/mcp/server-card.json
- OpenAPI (minimal): https://useclientproof.com/openapi.json
- Agent index: https://useclientproof.com/llms.txt

## Auth

Unauthenticated MCP POST returns HTTP 401 with `WWW-Authenticate` pointing at OAuth protected-resource metadata. v1 access tokens are rotatable **Pro-plan** agent keys from **Dashboard → MCP** (free/demo: studio session cookie only). Revoked keys stop working immediately. `GET /api/mcp` exposes `entitlements` and metering metadata.

## Install (Cursor)

```json
{
  "mcpServers": {
    "clientproof": {
      "url": "https://useclientproof.com/api/mcp",
      "headers": {
        "Authorization": "Bearer cp_mcp_REPLACE_WITH_DASHBOARD_KEY"
      }
    }
  }
}
```

Replace the Bearer token with a rotatable Pro-plan key from Dashboard → MCP ($29/mo). Free and demo studios can call the same URL with a session cookie instead. Streamable HTTP: POST JSON-RPC initialize, tools/list, and tools/call; GET returns the catalog or an SSE keepalive when authenticated. Unauthenticated calls receive HTTP 401 with OAuth protected-resource metadata. Approving testimonials and billing changes stay in the dashboard UI.

## Tool catalog

### list_clients

List every client workspace in the authenticated agency account. Use when you need slugs before get_collect_link, list_testimonials, or get_wall_embed_snippet. Do not use when you already know the slug. Side effects: none. Returns up to all clients (no pagination). Example: { clients: [{ name, slug, accent }] }.

**Parameters**

_No parameters._

**Side effects:** none (read-only). **Annotations:** readOnlyHint=true.

### get_collect_link

Return the public testimonial collection URL for one client workspace. Use when an agent should open or share the /c/{slug} form. Do not use for embed HTML (use get_wall_embed_snippet) or moderation (use list_testimonials). Required: slug from list_clients. Side effects: none.

**Parameters**

- `slug` — Client workspace slug from list_clients (URL segment in /c/{slug})

**Side effects:** none (read-only). **Annotations:** readOnlyHint=true.

### list_testimonials

List up to 50 testimonials for a client, newest first (no cursor pagination yet). Use when reviewing queue state or finding approved quotes. Do not use to approve/reject (dashboard only). Optional status: PENDING, APPROVED, or REJECTED. Required: slug. Side effects: none.

**Parameters**

- `slug` — Client workspace slug from list_clients
- `status` — When set, only testimonials in this moderation state are returned

**Side effects:** none (read-only). **Annotations:** readOnlyHint=true.

### get_wall_embed_snippet

Return copy-paste script and iframe snippets for the Wall of Love embed. Use when wiring a site with approved testimonials only. Do not use for collection links (get_collect_link) or pending queue review (list_testimonials with status PENDING). Required: slug. Side effects: none; does not change embed settings.

**Parameters**

- `slug` — Client workspace slug from list_clients

**Side effects:** none (read-only). **Annotations:** readOnlyHint=true.

## Limits

- **Read-only:** no tools approve, reject, or delete testimonials; no billing mutations.
- **Metering:** MCP is included in your Pro seat ($29/mo on useclientproof.com via Stripe) — not a separate add-on. Pro includes read-only agent tools, rotatable MCP agent API keys, and 5,000 included billable actions per UTC month when usage metering is turned on. Until then, fair use applies through per-plan rate limits. Free accounts can call the same read-only tools with a studio session (no agent keys). The shared demo at /demo uses Northline Studio the same way.
- **Scope:** tools only return data for clients in the authenticated agency account.

## HTML version

https://useclientproof.com/mcp