MCP integration for organizations

What is MCP

Authentication

PKCE flow (TypeScript, Node 20+)

End-to-end: dynamic registration → verifier/challenge → browser authorization → code exchange. Replace REDIRECT_URI with a URI allowed for your MCP host (loopback is fine for local tooling). After step 4, open authorizeUrl in a browser, sign in to Stratalize, approve consent, then paste the code from the redirect query.

import crypto from "node:crypto";
import * as readline from "node:readline/promises";

const ORIGIN = "https://www.stratalize.com";
const REDIRECT_URI = "http://127.0.0.1:43123/mcp-callback";
const LISTEN_PORT = 43123;

function base64url(buf: Buffer): string {
  return buf.toString("base64url");
}

function randomVerifier(): string {
  return base64url(crypto.randomBytes(32));
}

function challengeS256(verifier: string): string {
  return base64url(crypto.createHash("sha256").update(verifier, "utf8").digest());
}

async function registerClient(): Promise<string> {
  const res = await fetch(`${ORIGIN}/api/mcp/oauth/register`, {
    method: "POST",
    headers: { "content-type": "application/json", accept: "application/json" },
    body: JSON.stringify({
      client_name: "Stratalize MCP doc example",
      redirect_uris: [REDIRECT_URI],
    }),
  });
  if (!res.ok) throw new Error(`register failed ${res.status}: ${await res.text()}`);
  const j = (await res.json()) as { client_id: string };
  return j.client_id;
}

async function waitForRedirectCode(): Promise<string> {
  const http = await import("node:http");
  return new Promise((resolve, reject) => {
    const server = http.createServer((req, res) => {
      if (!req.url) return res.end();
      const url = new URL(req.url, REDIRECT_URI);
      const code = url.searchParams.get("code");
      const err = url.searchParams.get("error");
      res.setHeader("content-type", "text/plain");
      if (code) {
        res.statusCode = 200;
        res.end("You can close this tab and return to the terminal.");
        server.close();
        resolve(code);
      } else {
        res.statusCode = 400;
        res.end(err ?? "missing code");
        server.close();
        reject(new Error(err ?? "missing code"));
      }
    });
    server.listen(LISTEN_PORT, "127.0.0.1", () => {
      console.log(`Listening on ${REDIRECT_URI} for OAuth redirect...`);
    });
  });
}

async function exchangeToken(params: {
  code: string;
  clientId: string;
  verifier: string;
}): Promise<string> {
  const res = await fetch(`${ORIGIN}/api/mcp/oauth/token`, {
    method: "POST",
    headers: { "content-type": "application/json", accept: "application/json" },
    body: JSON.stringify({
      grant_type: "authorization_code",
      code: params.code,
      redirect_uri: REDIRECT_URI,
      client_id: params.clientId,
      code_verifier: params.verifier,
    }),
  });
  if (!res.ok) throw new Error(`token failed ${res.status}: ${await res.text()}`);
  const j = (await res.json()) as { access_token: string };
  return j.access_token;
}

async function main() {
  const clientId = await registerClient();
  const codeVerifier = randomVerifier();
  const codeChallenge = challengeS256(codeVerifier);
  const state = crypto.randomUUID();

  const authorizeUrl = new URL(`${ORIGIN}/api/mcp/oauth/authorize`);
  authorizeUrl.searchParams.set("response_type", "code");
  authorizeUrl.searchParams.set("client_id", clientId);
  authorizeUrl.searchParams.set("redirect_uri", REDIRECT_URI);
  authorizeUrl.searchParams.set("scope", "read:benchmarks read:market");
  authorizeUrl.searchParams.set("code_challenge", codeChallenge);
  authorizeUrl.searchParams.set("code_challenge_method", "S256");
  authorizeUrl.searchParams.set("state", state);

  console.log("Open this URL, complete login + consent:\n", authorizeUrl.toString());
  const code = await waitForRedirectCode();
  const accessToken = await exchangeToken({ code, clientId, verifier: codeVerifier });
  console.log("access_token prefix:", accessToken.slice(0, 16));

  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
  const answer = await rl.question(
    "Call tools/list against /api/mcp? [y/N] ",
  );
  rl.close();
  if (answer.trim().toLowerCase() !== "y") return;

  const mcpRes = await fetch(`${ORIGIN}/api/mcp`, {
    method: "POST",
    headers: {
      accept: "application/json, text/event-stream",
      "content-type": "application/json",
      authorization: `Bearer ${accessToken}`,
    },
    body: JSON.stringify({
      jsonrpc: "2.0",
      id: "a0eebc99-9c0b-4ef8-bb6d-6bb9bd380a11",
      method: "tools/list",
      params: {},
    }),
  });
  console.log("tools/list status:", mcpRes.status);
  console.log((await mcpRes.text()).slice(0, 2000));
}

main().catch((e) => {
  console.error(e);
  process.exit(1);
});

Tool discovery

POST /api/mcp HTTP/1.1
Host: www.stratalize.com
Authorization: Bearer sk_mcp_…
Accept: application/json, text/event-stream
Content-Type: application/json

{
  "jsonrpc": "2.0",
  "id": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
  "method": "tools/list",
  "params": {}
}

Invalid arguments on methods that validate params surface as JSON-RPC -32602 Invalid params where the MCP handler applies schema validation; transport-level parse failures return -32700 per JSON-RPC 2.0.

Tool invocation

{
  "jsonrpc": "2.0",
  "id": "6ba7b810-9dad-11d1-80b4-00c04fd430c8",
  "method": "tools/call",
  "params": {
    "name": "get_spend_summary",
    "arguments": { "period": "30d" }
  }
}

Example result shape (illustrative)

{
  "jsonrpc": "2.0",
  "id": "6ba7b810-9dad-11d1-80b4-00c04fd430c8",
  "result": {
    "content": [
      {
        "type": "text",
        "text": "{ \"data\": { … }, \"_stratalize\": { \"signed_at\": \"…\", \"signature\": \"…\", \"public_key_url\": \"https://www.stratalize.com/api/trust/signing-key\", \"canonicalization\": \"JCS-RFC8785\", \"version\": \"1\" } }"
      }
    ]
  }
}

Scopes and permissions

Additional allowlisted scopes

Keys may also include, where issued: read:market, read:actions, read:alerts, read:healthcare, write:strategy, ask:stratalize, read:trader, admin — see McpScope and MCP_ALLOWLIST_SCOPES in lib/mcp/scopes.ts. get_morning_briefing requires read:roles, read:actions, and read:intelligence simultaneously (app/api/mcp/route.ts).

Public vs org-authenticated

Quickstart (tools/list)

After OAuth exchange (or when using a dashboard-issued key), call /api/mcp with JSON-RPC. Use the same Accept header as production clients.

const res = await fetch("https://www.stratalize.com/api/mcp", {
  method: "POST",
  headers: {
    authorization: `Bearer ${process.env.STRATALIZE_MCP_KEY}`,
    accept: "application/json, text/event-stream",
    "content-type": "application/json",
  },
  body: JSON.stringify({
    jsonrpc: "2.0",
    id: "550e8400-e29b-41d4-a716-446655440000",
    method: "tools/list",
    params: {},
  }),
});
console.log(res.status, await res.text());

Failure modes

Registry

Related: x402, Tool catalog, /.well-known/mcp.json.