Tools

MCP

The Model Context Protocol (MCP) lets an AI assistant or agent call tools and read resources from an external server, so it can browse the marketplace or manage a seller's listings and orders through natural-language tool calls instead of hand-written HTTP requests. TCG Plein runs two MCP servers, both built on the same v1 API documented throughout this site.

Servers

Server	Endpoint	Auth	Rate limit
TCG Plein Catalog	`POST /mcp`	None: open to everyone	60 requests/minute per IP
TCG Plein Seller	`POST /mcp/seller`	OAuth: log in and approve in the browser	Same limits as the REST API

The catalog server is public: any assistant can browse sets, cards, sealed products and their active listings without an account. The seller server authenticates one way only: OAuth. Your MCP client opens the browser, you log in to TCG Plein and approve the connection; API keys are a REST-only credential and are not accepted here. Approving requires API access on your account, the same gate that governs issuing keys (see Getting access). What a connected assistant may then do is up to you: the MCP permissions on your dashboard's API page (all seller scopes by default, adjustable down to read-only or off, effective immediately for already-connected assistants). Every seller call is logged and rate-limited like a REST request, each seller tool checks its scope against your permissions before it runs, and a session missing a permission can still connect and list every tool; only the call itself fails.

Connect a client

Claude Code

Add the public catalog server, no credentials needed:

claude mcp add --transport http tcgplein https://tcgplein.nl/mcp

Add the seller server the same way; your browser opens to log in and approve the connection on first use:

claude mcp add --transport http tcgplein-seller https://tcgplein.nl/mcp/seller

Other MCP clients

Any client that speaks the MCP HTTP transport can connect with a plain JSON config:

{
  "mcpServers": {
    "tcgplein": {
      "url": "https://tcgplein.nl/mcp"
    },
    "tcgplein-seller": {
      "url": "https://tcgplein.nl/mcp/seller"
    }
  }
}

Catalog tools

Read-only, unauthenticated, returning public data only: no seller url, tier or rating, just their display name on any listing summary.

Tool	What it does
search_catalog	Free-text search across cards and/or sealed products. Compact rows only, capped at 25 per call.
get_set	Look up a set by its canonical id or a friendly shortcut, optionally including up to 50 of its visible cards.
get_card	Look up a card by canonical or friendly id, with a summary of its active marketplace listings.
get_product	Look up a sealed product by slug, with a summary of its active marketplace listings.

An ambiguous friendly id (see Identifiers) returns the same candidates message as the REST API, just rendered as an MCP tool error instead of a JSON error envelope.

Money in tool results

Every amount a tool returns is a decimal figure, never minor units: 725 means seven hundred twenty-five euros, not €7,25. The currency sits beside the amount it belongs to, as currency on each listing and order line, on the totals block of an order, and once at the top level of a search_catalog result, where it covers every price_from in the rows. It is always EUR today.

Seller tools

Every seller tool only ever reads or writes data owned by the key's seller account; another seller's listings and orders are never visible, not even to confirm they exist. A call fails with an authorization error if your MCP permissions lack the scope listed below.

Tool	Scope	What it does
list_listings	listings:read	List your own listings, filterable by status, card or sealed product. Capped at 25 per call.
create_listings	listings:write	Bulk-create up to 25 listings in one call (the REST endpoint allows 100; the MCP cap keeps a single response bounded for token economy). Requires a fully verified Stripe payouts setup, same as REST. Reports per-item results, one bad item never fails the whole batch, and warns when the account has no shipping options enabled.
update_listing	listings:write	Update price, quantity, status or description on one of your own listings. Quantity dropping to 0 automatically hides an active listing as sold; restocking a sold listing reactivates it.
list_orders	orders:read	List your own sales as order lines, filterable by status or a since date. Capped at 25 per call.
get_order	orders:read	Read the full shipment slice for one order: every line, totals, the buyer's name and address, and the shipping/tracking status.
ship_order	orders:write	Mark every still-pending line of an order's slice as shipped, with an optional tracking code, and notify the buyer.
get_shipping_label	orders:write	Generate or refetch an order's shipping label. Returns a signed download URL valid 5 days once ready; async carriers may report processing or action_required instead.

get_order deliberately never includes the label download URL: reading order status is a routine, cheap call, and minting a fresh 5 day signed URL on every read would burn one for nothing. Call get_shipping_label when you actually need the label link.

Resources

Both servers expose an openapi resource at the uri docs://openapi/v1: the same hand-maintained OpenAPI 3.1 document served at https://tcgplein.nl/api/openapi.json. Read it as a resource to give a client the full REST reference without leaving the MCP session.

OAuth

Connecting to the seller server starts a standard OAuth flow: it answers with a 401 whose WWW-Authenticate header points at /.well-known/oauth-protected-resource, your client registers itself (dynamic client registration, PKCE, no client secret) and opens the browser. You log in to your TCG Plein account, see exactly what the app will be able to do, and approve or decline.

Approval requires API access on your account, the same gate that governs issuing API keys (see Getting access). Without it the approval screen explains how to request access first, and any token is refused with a 403.
What a session may do follows your MCP permissions on the dashboard API page: every scope by default, adjustable down to read-only or fully off. Changes apply immediately, also to assistants that are already connected.
Access tokens live 1 day and refresh automatically for 30 days, so an assistant stays connected without re-approval. Rate limits and call logging match the REST API.