MCP Gateway MCP Server

Cancel a UCP checkout session. Transitions to 'canceled' status. Cannot cancel already completed checkouts. PAYMENT MANDATE: this tool also requires one. Send it as the `payment_mandate` argument if your client cannot set headers, or as an `X-Payment-Mandate` header. It must carry `mandate_id`, `max_amount_cents`, `currency`, `exp`, `sub`, `aud`. Two of these are rejected outright if guessed: `exp` is an INTEGER of Unix seconds (not an ISO 8601 date), and `aud` is this store's slug (the one in the URL you are calling, not a domain). Its `currency` must match the cart's currency, and the cap in `max_amount_cents` is enforced against the cart total.

Create a UCP checkout session from line items. Returns a UCP checkout object with status 'incomplete'. PAYMENT MANDATE: this tool also requires one. Send it as the `payment_mandate` argument if your client cannot set headers, or as an `X-Payment-Mandate` header. It must carry `mandate_id`, `max_amount_cents`, `currency`, `exp`, `sub`, `aud`. Two of these are rejected outright if guessed: `exp` is an INTEGER of Unix seconds (not an ISO 8601 date), and `aud` is this store's slug (the one in the URL you are calling, not a domain). Its `currency` must match the cart's currency, and the cap in `max_amount_cents` is enforced against the cart total.

Retrieve a UCP checkout session by ID. Returns the current state of the checkout. PAYMENT MANDATE: this tool also requires one. Send it as the `payment_mandate` argument if your client cannot set headers, or as an `X-Payment-Mandate` header. It must carry `mandate_id`, `max_amount_cents`, `currency`, `exp`, `sub`, `aud`. Two of these are rejected outright if guessed: `exp` is an INTEGER of Unix seconds (not an ISO 8601 date), and `aud` is this store's slug (the one in the URL you are calling, not a domain). Its `currency` must match the cart's currency, and the cap in `max_amount_cents` is enforced against the cart total.

Update a UCP checkout session by fully replacing all line items. Only allowed when status is 'incomplete'. PAYMENT MANDATE: this tool also requires one. Send it as the `payment_mandate` argument if your client cannot set headers, or as an `X-Payment-Mandate` header. It must carry `mandate_id`, `max_amount_cents`, `currency`, `exp`, `sub`, `aud`. Two of these are rejected outright if guessed: `exp` is an INTEGER of Unix seconds (not an ISO 8601 date), and `aud` is this store's slug (the one in the URL you are calling, not a domain). Its `currency` must match the cart's currency, and the cap in `max_amount_cents` is enforced against the cart total.

Search products in Demo Store. Returns matching products with prices, images, availability, and direct links. Results include data for generating a visual product carousel artifact with category filtering.

Search products with enriched data including structured attributes, variants, GTIN, and images. Ideal for comparison and detailed product discovery. Matching is keyword/substring-based (title, description, tags, vendor) with rating-then-review ordering — the rating and review count it orders by are asserted by the merchant and are not verified by Trusteed. Use this when you have concrete keywords, a category, or a price range.

Apply a discount or promo code to the cart. SKYFIRE TOKEN (optional): Pass a kya or kya-pay token in the skyfire-pay-id header to boost trust score. No token required — request proceeds normally if omitted. PAYMENT MANDATE: this tool also requires one. Send it as the `payment_mandate` argument if your client cannot set headers, or as an `X-Payment-Mandate` header. It must carry `mandate_id`, `max_amount_cents`, `currency`, `exp`, `sub`, `aud`. Two of these are rejected outright if guessed: `exp` is an INTEGER of Unix seconds (not an ISO 8601 date), and `aud` is this store's slug (the one in the URL you are calling, not a domain). Its `currency` must match the cart's currency, and the cap in `max_amount_cents` is enforced against the cart total. CREDENTIAL: this store needs one. Call the `create_sandbox_key` tool first (it is in this tool list and needs no credential), then pass the key you get back as the `agent_key` argument — or as an `Authorization: Bearer` header if your client can set headers. Do not ask a person to log in: there is no human login for this store.

List all product categories in Demo Store with product counts.

Create a shopping cart in Demo Store. Returns a cart_id for use with get_shipping_rates, preview_checkout, and complete_checkout. SKYFIRE TOKEN (optional): Provide a kya or kya-pay Skyfire token in the skyfire-pay-id request header to boost your agent trust score (up to +0.35), which may unlock better pricing or priority service. No token required — request proceeds with neutral trust score (0.50) if omitted or invalid. PAYMENT MANDATE: this tool also requires one. Send it as the `payment_mandate` argument if your client cannot set headers, or as an `X-Payment-Mandate` header. It must carry `mandate_id`, `max_amount_cents`, `currency`, `exp`, `sub`, `aud`. Two of these are rejected outright if guessed: `exp` is an INTEGER of Unix seconds (not an ISO 8601 date), and `aud` is this store's slug (the one in the URL you are calling, not a domain). Its `currency` must match the cart's currency, and the cap in `max_amount_cents` is enforced against the cart total. CREDENTIAL: this store needs one. Call the `create_sandbox_key` tool first (it is in this tool list and needs no credential), then pass the key you get back as the `agent_key` argument — or as an `Authorization: Bearer` header if your client can set headers. Do not ask a person to log in: there is no human login for this store.

Compare 2 to 5 products side-by-side with normalized attribute table and best-value recommendation.

Complete the purchase. Collects buyer contact info via elicitation if supported. Idempotent — replay is keyed on checkout_session_id: any retry against a session that already has an order returns that same order (COMPLETED or PENDING_EXTERNAL_CONFIRMATION) without re-charging. The provided idempotency_key is recorded on the session for audit and short-circuits a repeated call with the same key. SKYFIRE TOKEN (payment_method=KYAPAY): Requires a Skyfire pay or kya-pay token. Preferred: pass the JWT in the skyfire-pay-id request header. Alternative: pass as kyapay_token parameter. Claims validated: sub (account ID), jti (replay prevention), amount (USD, matched against cart total), cur (must be USD), sps (pricing scheme). Missing token with KYAPAY method → error. Invalid token → error 'Invalid Skyfire token'. For other payment methods (MOCK, PAYPAL) no Skyfire token is required. PAYMENT MANDATE: this tool also requires one. Send it as the `payment_mandate` argument if your client cannot set headers, or as an `X-Payment-Mandate` header. It must carry `mandate_id`, `max_amount_cents`, `currency`, `exp`, `sub`, `aud`. Two of these are rejected outright if guessed: `exp` is an INTEGER of Unix seconds (not an ISO 8601 date), and `aud` is this store's slug (the one in the URL you are calling, not a domain). Its `currency` must match the cart's currency, and the cap in `max_amount_cents` is enforced against the cart total. CREDENTIAL: this store needs one. Call the `create_sandbox_key` tool first (it is in this tool list and needs no credential), then pass the key you get back as the `agent_key` argument — or as an `Authorization: Bearer` header if your client can set headers. Do not ask a person to log in: there is no human login for this store.

Full-text search across all Trusteed public documentation: pages, blog posts, and FAQ entries. Returns ranked results by relevance. Use this to find answers about protocols, pricing, integration guides, trust scores, and more.

Get the complete profile — trust score, policies, compliance, and protocol support — of the merchant this MCP endpoint belongs to. Takes NO parameters: the merchant is fixed by which store's /:storeSlug/mcp endpoint you connected to, not by an argument. To read a different merchant's profile, call this same tool on that merchant's own endpoint instead.

Read the content of a specific page on Trusteed. Pass the page slug (e.g. 'for-agents', 'pricing', 'blog') or a blog post slug. Use get_site_map first to discover available slugs. Pass page='blog' to list all blog posts.

Preview the complete order summary before payment. Advances the session to ready-for-payment state. SKYFIRE TOKEN (optional): Pass a kya or kya-pay token in the skyfire-pay-id header to boost trust score. No token required — request proceeds normally if omitted. PAYMENT MANDATE: this tool also requires one. Send it as the `payment_mandate` argument if your client cannot set headers, or as an `X-Payment-Mandate` header. It must carry `mandate_id`, `max_amount_cents`, `currency`, `exp`, `sub`, `aud`. Two of these are rejected outright if guessed: `exp` is an INTEGER of Unix seconds (not an ISO 8601 date), and `aud` is this store's slug (the one in the URL you are calling, not a domain). Its `currency` must match the cart's currency, and the cap in `max_amount_cents` is enforced against the cart total. CREDENTIAL: this store needs one. Call the `create_sandbox_key` tool first (it is in this tool list and needs no credential), then pass the key you get back as the `agent_key` argument — or as an `Authorization: Bearer` header if your client can set headers. Do not ask a person to log in: there is no human login for this store.

Get detailed information about a specific product in Demo Store, including all variants, sizes, colors, and availability.

Get a temporary sandbox credential for this demo store, valid 24h. Present it as an `Authorization: Bearer` header, or — when your client cannot set headers — as the `agent_key` argument of the checkout tools. Payments here are simulated: this credential settles nothing and works only on the demo store. No human login is involved at any point.

Select a shipping method for the cart. Must call get_shipping_rates first. SKYFIRE TOKEN (optional): Pass a kya or kya-pay token in the skyfire-pay-id header to boost trust score. No token required — request proceeds normally if omitted. PAYMENT MANDATE: this tool also requires one. Send it as the `payment_mandate` argument if your client cannot set headers, or as an `X-Payment-Mandate` header. It must carry `mandate_id`, `max_amount_cents`, `currency`, `exp`, `sub`, `aud`. Two of these are rejected outright if guessed: `exp` is an INTEGER of Unix seconds (not an ISO 8601 date), and `aud` is this store's slug (the one in the URL you are calling, not a domain). Its `currency` must match the cart's currency, and the cap in `max_amount_cents` is enforced against the cart total. CREDENTIAL: this store needs one. Call the `create_sandbox_key` tool first (it is in this tool list and needs no credential), then pass the key you get back as the `agent_key` argument — or as an `Authorization: Bearer` header if your client can set headers. Do not ask a person to log in: there is no human login for this store.

Get available shipping rates for the cart. Collects shipping address via elicitation if supported. SKYFIRE TOKEN (optional): Pass a kya or kya-pay token in the skyfire-pay-id header to boost trust score. No token required — request proceeds normally if omitted. PAYMENT MANDATE: this tool also requires one. Send it as the `payment_mandate` argument if your client cannot set headers, or as an `X-Payment-Mandate` header. It must carry `mandate_id`, `max_amount_cents`, `currency`, `exp`, `sub`, `aud`. Two of these are rejected outright if guessed: `exp` is an INTEGER of Unix seconds (not an ISO 8601 date), and `aud` is this store's slug (the one in the URL you are calling, not a domain). Its `currency` must match the cart's currency, and the cap in `max_amount_cents` is enforced against the cart total. CREDENTIAL: this store needs one. Call the `create_sandbox_key` tool first (it is in this tool list and needs no credential), then pass the key you get back as the `agent_key` argument — or as an `Authorization: Bearer` header if your client can set headers. Do not ask a person to log in: there is no human login for this store.

Returns the complete site map of Trusteed: all public pages organized by category. Use this to discover what sections are available (docs, blog, integrations, legal, marketing) and find the right path before calling get_page_content.