MCP

MCP (Model Context Protocol) exposes the same read data and checkout-link write as the REST API as tools an AI agent can call directly, so an assistant like Claude can answer "which subscribers are past due" or "create a checkout link for this tier" without you writing a custom integration.

Endpoint

https://api.arcalotl.com/mcp

Streamable HTTP transport. Authenticate with the same bearer API keys as the REST API (Authorization: Bearer arclt_live_...), created in the dashboard under Developers -> API Keys. Every tool call is scoped to the key's community and enforces the same scope as its REST equivalent.

Client configuration

Claude Code

claude mcp add --transport http arcalotl https://api.arcalotl.com/mcp \
  --header "Authorization: Bearer arclt_live_..."

Generic `mcpServers` configuration

Most MCP-compatible clients (Claude Desktop, Cursor, and others) accept the same shape:

{
  "mcpServers": {
    "arcalotl": {
      "url": "https://api.arcalotl.com/mcp",
      "headers": {
        "Authorization": "Bearer arclt_live_..."
      }
    }
  }
}

Tools

Tool	Input	Scope
`list_subscriptions`	`status?, plan_id?, member_id?, cursor?, limit?`	`subscriptions:read`
`get_subscription`	`subscription_id`	`subscriptions:read`
`list_plans`	(none)	`plans:read`
`list_members`	`cursor?, limit?`	`members:read`
`get_member_entitlements`	`member_id`	`members:read`
`check_entitlement`	`platform, platform_uid, tier_id?`	`members:read`
`list_purchases`	`cursor?, limit?`	`purchases:read`
`get_analytics_summary`	(none)	`analytics:read`
`list_events`	`types?, after_id?, limit?`	`events:read`
`list_webhook_endpoints`	(none)	`webhooks:read`
`list_webhook_deliveries`	`endpoint_id, cursor?`	`webhooks:read`
`create_checkout_link`	`tier_id, platform, platform_uid, plan_id?`	`checkout:write`

Tool results are the same public JSON DTOs as the REST responses. A key missing the required scope gets a scope-denial error from the tool call, the same as a 403 missing_scope over REST.

There is no cancel_subscription tool. Destructive writes driven by an agent are deliberately out of scope for MCP; use POST /v1/subscriptions/{id}/cancel directly for that. create_checkout_link is the only write tool.

Why one service, two protocols

MCP tools call the same internal application service the REST handlers call, in-process, not the REST API over HTTP. That means every resource, filter, and scope check behaves identically whether you reach Arcalotl through curl or through an agent, and any bug fix or new field lands in both at once.