MCP server

https://api.sailo.store/api/mcp

Sailo runs a Model Context Protocol server. Point Claude, Cursor, or any MCP client at that address with an API key as a bearer token, and it can read a shop’s orders, products and contacts — and, with a write key, add contacts and change their tags.

The same key, the same rules

One HTTP endpoint, one bearer token, no OAuth dance and no separate registration. The key is the same one the REST API takes, because they are one grant: this program may act on my shop, within these scopes.

Which means everything on the authentication page applies here unchanged — the same scopes, the same plan gate checked on every call, the same 240 requests a minute shared between the two surfaces, and one revocation that closes both.

Every tool is the REST endpoint

Not a reimplementation, not a “simplified” version — the same function, with the same shop id in the same WHERE.

That is the most important property of this server and it is deliberate. Two implementations of “list this shop’s orders” would be two ownership checks, and the one that drifted would be the way into somebody else’s shop. An assistant and an integrator get identical behaviour because they are one code path.

What it is for

The honest answer is: asking questions of a shop in words, and doing the small number of things an assistant can safely do.

“How many orders did we take last week, and what was the total?”
“Find everything ada@example.com has bought.”
“Which products are nearly out of stock?”
“Add everybody who came to the webinar to the list and tag them.”

What it is not for is running the shop. An assistant cannot refund, ship, cancel, publish, or change a price — see what it can do for the full line.

A key is a key. An assistant holding one can do everything that key can do, and it will do it without asking you again each time. Mint a read-only key unless you specifically want an assistant writing to your list.

At a glance


Endpoint	`https://api.sailo.store/api/mcp`
Transport	Streamable HTTP, `POST` only
Auth	`Authorization: Bearer sailo_sk_…`
Tools	9 — 7 read, the rest need a write key
Protocol	2026-07-28, and the handshake for 2025-11-25, 2025-06-18
Sessions	None. Every request carries its own credential.
Rate limit	Shared with the REST API — 240 a minute per key
Tool call ceiling	60 seconds

Connecting a client — Claude Code, Claude Desktop, Cursor, VS Code, and anything else.
What it can do — the full line, in both directions.
Tool reference — all 9, with their arguments.
Protocol — versions, methods, errors, and curl.

Getting a key

The MCP server is on the Business plan. Every key is read-only unless you tick write, and is shown once at creation. Create one under Settings → Integrations.