Presscart MCP server

Presscart MCP

The official Model Context Protocol server for Presscart, a marketplace for disclosed paid editorial placements across 1,700+ publications. It lets AI assistants and agents browse the outlet catalog, manage campaigns and orders, and track article status through the Presscart API.

Hosted endpoint: https://mcp.presscart.com/mcp — see Client Setup for connecting from Claude, Cursor, VS Code, ChatGPT, and other MCP clients. A Presscart account is required.

Supports:

• hosted Streamable HTTP mode

Hosted HTTP mode supports two auth models:

• MCP OAuth mode: Supabase/Auth issues the OAuth token, and clients connect to /mcp with Authorization: Bearer .
• Legacy direct-token mode: the caller provides a Presscart API token via X-Presscart-API-Token, and the server uses that token as the upstream Presscart credential.

Environment

Required:

export PRESSCART_API_URL="http://api.presscart.com/"

Optional app link settings:

export PRESSCART_APP_URL="https://app.presscart.com"

Optional hosted mode settings:

export MCP_HOST="0.0.0.0"
export MCP_PORT="8787"
export MCP_SERVER_URL="https://mcp.presscart.com/mcp"
export MCP_SESSION_IDLE_TTL_MS="43200000"

Optional host/origin overrides for reverse proxies or multiple domains:

export MCP_ALLOWED_HOSTS="mcp.presscart.com"
export MCP_ALLOWED_ORIGINS="https://mcp.presscart.com,https://claude.ai,https://claude.com"

When MCPALLOWEDORIGINS is not set, hosted mode allows the configured MCP server origin plus Claude's remote connector origins.

Optional OAuth settings:

export MCP_OAUTH_ENABLED="true"
export MCP_OAUTH_ISSUER_URL="https://<project-ref>.supabase.co/auth/v1"
export MCP_OAUTH_AUDIENCE="https://mcp.presscart.com/mcp"
export MCP_OAUTH_TRANSLATOR_ENABLED="false"
export MCP_OAUTH_LEGACY_AUDIENCE="https://mcp.presscart.com"
export MCP_OAUTH_UPSTREAM_TIMEOUT_MS="10000"

Notes:

• PRESSCARTAPIURL must point at the app API base that exposes /teams/* routes, not a public-api-only base.
• PRESSCARTAPPURL controls direct application links returned by tools such as listpublisherarticles. Set it per environment so staging MCP links open staging.
• Tools that create orders/campaigns or read profile orders need an explicit profileid. If the profile is unknown, call listteams, then list_profiles.
• In MCP OAuth mode, the app's Supabase OAuth Server handles authorization and consent. This MCP runtime validates the issued access token against Supabase JWKS and delegated permissions.
• MCPOAUTHTRANSLATOR_ENABLED defaults to false. When enabled, the MCP origin publishes a standards-based OAuth facade while Supabase remains responsible for clients, codes, tokens, rotation, signing, and consent.
• MCPOAUTHISSUER_URL must use HTTPS. Loopback HTTP issuers are accepted only for local development.
• MCPOAUTHLEGACY_AUDIENCE is an optional verifier-only migration value and must equal the configured MCP server origin (for example, https://mcp.presscart.com). It cannot duplicate the canonical /mcp resource or name another service, and it never changes the protected resource advertised to clients.
• MCP clients store their own refresh tokens, initiate refresh automatically, and replace rotated refresh and access tokens. This server handles the refresh request statelessly and does not store refresh tokens.
• The translator changes only MCP OAuth. It does not change ordinary Presscart browser or app sessions, and disabling MCP OAuth still preserves legacy direct-token mode.
• In legacy direct-token mode, send X-Presscart-API-Token: on initialize and later requests that need to confirm the active session credential.

Install

cd presscart-mcp
npm install

Run

Development:

npm run dev:http

Shortened. The full README is on GitHub.