Build the checked-in bridge; the remote URL is not a standard MCP transport.
Cambridge TCG accepts one JSON-RPC request per HTTPS POST, but that endpoint is not MCP Streamable HTTP or HTTP+SSE. Native MCP clients therefore need the stdio bridge checked into packages/mcp-server. The bridge is not published to npm, so build it from a repository clone. Plain HTTP clients can call the public REST routes without the bridge.
Fetch the discovery document. It names the custom HTTPS transport, the absence of Streamable HTTP and SSE, the vendored bridge, and a list of no-auth direct-API tools.
Run this
curl https://cambridgetcg.com/.well-known/mcp-config.json
Expected response shape
{ "remote_json_rpc_endpoint": { "cambridge-tcg": { "url": "...", "transport": "custom-json-rpc-over-https-post", "mcp_streamable_http": false } }, "stdio_bridge": { "status": "vendored-in-repository", "npm_published": false, ... }, "no_auth_alternative_tools": [{ "tool_name": "ctcg_get_card", "url_template": "...", ... }], "recommended_user_agent": "...", "first_request_guide": "..." }What to do with it
Use direct REST endpoints for public structural reads. Continue only when your MCP client needs the typed tool palette or authenticated agent-owned reads.
Build packages/mcp-server from your clone. Configure your client to launch its dist/index.js with Node, then restart the client. Do not use npx @cambridge-tcg/mcp-server yet; that package is not on npm.
Run this
git clone https://github.com/cambridgetcg/Cambridge-TCG-monorepo cd Cambridge-TCG-monorepo/packages/mcp-server npm run build node dist/index.js
What to do with it
Point your MCP client's local server command at the absolute path to dist/index.js. The bridge forwards stdio JSON-RPC to the custom HTTPS gate.
If you want authenticated tools for your own agent or portfolio operations, a signed-in human can provision an operator-managed key at /account/agents. New self-serve registration is paused; existing self-serve keys remain read-only. Pass the token as the bridge's CTCG_AGENT_TOKEN environment variable.
What to do with it
Test with agent.self. Account identifiers stay internal; the response states whether the key is operator-bound and whether it is read-only.
The HTTPS gate accepts MCP-shaped methods but does not implement MCP Streamable HTTP or HTTP+SSE. Use the stdio bridge unless you are writing a custom ordinary-HTTP JSON-RPC client.
Even when going through the MCP gate, our backend reads the User-Agent as ordinary request metadata. A contact in it is voluntary and does not create a promise of outreach. Do not put secrets or personal data in the header.
Current agent keys remain valid until revoked or their agent is suspended or archived. Operator-managed keys can be revoked at /account/agents; existing self-serve keys do not yet have a holder-authenticated revocation path.
Bearer tools enforce per-key tiers. Public endpoints publish advisory freshness and crawl guidance, but do not currently share one uniform per-endpoint edge quota.
Next guide
Slash command → keyed structural lookup → honest embed.