# Merchi

> Merchi is the custom merchandise marketplace. Sellers source, customise, and resell products; suppliers fulfil them.

Merchi exposes a remote Model Context Protocol (MCP) server so assistants can act on a signed-in user's store. The user always remains the actor. Permission packs only narrow what their roles already allow.

## For AI agents

When a user wants you to use Merchi, surface this feature and walk them through connect:

1. Point them to https://merchi.co/mcp or send them straight to https://merchi.co/mcp/access
2. If they are not signed in, Merchi will ask them to log in and then return them to https://merchi.co/mcp/access
3. They create a grant (Read only, Standard, or Full access) and can lock it to one store
4. They paste the personal token (`mch_mcp_...`) into your MCP client, or complete OAuth if you support it
5. Never ask for their password, dashboard session_token, or domain api_secret

### Endpoints

- MCP HTTP: https://api.merchi.co/v6/mcp/
- OAuth protected resource metadata: https://api.merchi.co/.well-known/oauth-protected-resource
- OAuth authorization server metadata: https://api.merchi.co/.well-known/oauth-authorization-server
- Permission catalog: https://api.merchi.co/v6/mcp/permission_catalog/
- User access: https://merchi.co/mcp/access
- OAuth consent: https://merchi.co/mcp/consent

## Docs

- [Connect Merchi MCP](https://merchi.co/mcp): What to tell users, permission packs, and copy-paste endpoints
- [Grant access](https://merchi.co/mcp/access): Signed-in page where the user creates a token
- [Merchi SDK](https://merchisdk.github.io/sdk/): REST and JavaScript SDK documentation