This page describes how to use the MCP server as an agent or MCP client. For the underlying endpoints and schemas,
see the API v3 reference.
Endpoint
The server speaks the standard MCP protocol over HTTP, so most MCP clients can connect to it, including Claude, Claude Code, ChatGPT, VS Code, and agents built on an MCP SDK.
Your MCP client must support OAuth Client ID Metadata Documents
(CIMD) to
sign in. Some clients don’t support CIMD yet and can’t connect to the Sendcloud MCP server, for example
Cursor.
Connecting
1
Add the server to your MCP client
Point your client at the MCP URL. For example, with the Claude Code CLI:Other clients (Claude Desktop, custom agents) accept the same URL in their MCP server configuration. A typical JSON config looks like:
2
Authorize with OAuth 2.0
The first time your client connects, it discovers the authorization server automatically (via RFC 9728 protected-resource metadata) and walks you through an OAuth 2.0 sign-in at
account.sendcloud.com. The consent screen lets you pick which permission groups to grant (see Choosing permissions). After you approve access, the client stores the resulting token and attaches it to every tool call.Your credentials live in the MCP client, never in the server. See Authentication for how Sendcloud OAuth 2.0 works.3
Discover and call tools
Once connected, the client lists the available tools. Ask the agent to perform a task (for example “list my most recent orders” or “track parcel 123456789”) and it selects and calls the matching tool, forwarding the request to the Public API v3 and returning the response.
Selecting toolsets
By default the server exposes all toolsets. To limit a connection to a subset (for example keeping the agent’s tool list focused and relevant) add a?toolsets= query parameter with a comma-separated list of toolset names:
Choosing permissions
When you authorize the connection, the consent screen lists permission groups such as Orders, Shipping, and Returns. Each group grants a set of OAuth 2.0 scopes, and the token your client receives can only do what those scopes allow. Toolsets control which tools the agent sees. Scopes control what the agent is allowed to do with your account. For example, you can let an agent read your parcels without allowing it to create or announce shipments. To change your permissions, re-authenticate the connection in your MCP client and select a different set of groups. See Scopes for OAuth apps for the scopes in each group.Available toolsets
Each toolset maps to one Public API v3 domain. Its tools need the scopes for that domain, as listed in Scopes for OAuth apps.How tools map to the API
Tool naming and namespacing
Tool naming and namespacing
Each tool corresponds to one HTTP operation. The tool name is derived from the operation’s
operationId, and is namespaced by toolset to avoid collisions — for example orders_sc_public_v3_orders_get_list_orders (list orders) or shipments_sc_public_v3_scp_get_shipment_by_id (retrieve a shipment).The operation’s path, query, and header parameters — plus the request-body fields — become the tool’s arguments. Required API parameters stay required on the tool.Safety annotations
Safety annotations
Tools are annotated with hints about their effect, derived from the HTTP method: read-only (
GET), idempotent, or destructive (DELETE, POST). MCP clients use these to auto-confirm safe lookups while prompting you before a tool that creates, cancels, or deletes data.Next steps
Authentication
How Sendcloud OAuth 2.0 works
Scopes
The permissions each consent group grants
API v3 reference
The endpoints behind every MCP tool