MCP server

The Biometry MCP server lets an AI agent (Claude, Cursor, VS Code, ChatGPT) read your Biometry data over the Model Context Protocol. You sign in through a browser OAuth flow — the same way you connect a GitHub or Anthropic connector — and the agent gets scoped, read-only access to your profile, transactions, and fraud events.

Endpoint: https://mcp.biometrysolutions.com/mcp (Streamable HTTP)

Access is read-only and scoped to the account you sign in as. No API key is involved; the agent never sees your password.

Connect

Claude (and other connector-based clients)

Open your client’s connector / MCP server settings.
Add a custom connector with URL https://mcp.biometrysolutions.com/mcp.
Sign in when prompted. A browser opens the Biometry sign-in page; after you authorize, the agent’s tools become available.

Clients self-register via dynamic client registration (RFC 7591) — there is no client ID or secret to configure.

Config-file clients (Cursor, VS Code, Claude Desktop)

Add the server to the client’s MCP config:

{
  "mcpServers": {
    "biometry": {
      "url": "https://mcp.biometrysolutions.com/mcp"
    }
  }
}

On first use the client runs the OAuth flow in your browser.

MCP Inspector (testing)

npx @modelcontextprotocol/inspector
# Transport: Streamable HTTP → URL: https://mcp.biometrysolutions.com/mcp → Quick OAuth Flow

Authentication

The server is an OAuth 2.1 resource server; biometry-auth is the authorization server. The flow is standard and handled by your MCP client:

The client calls /mcp unauthenticated and receives 401 with WWW-Authenticate: Bearer resource_metadata=….
It fetches /.well-known/oauth-protected-resource to discover the authorization server.
It registers (RFC 7591), then runs browser login with PKCE at https://api.biometrysolutions.com/api-auth.
It calls /mcp with the resulting bearer token; the server verifies it and runs tools.

Issued tokens are audience-bound to this server — a token minted for any other resource is rejected. The server never forwards your token downstream: it exchanges your verified identity for a short-lived internal token to read your data.

Scopes

Requested during sign-in. Grant only what the agent needs.

Scope	Grants
`biometry:profile`	Read your account profile
`biometry:transactions:read`	Read transactions and sessions
`biometry:fraud:read`	Read fraud detection events
`offline_access`	Refresh tokens (stay signed in)

Tools

Tool	Scope	Description
`get_current_time`	—	Current server time
`get_my_profile`	`biometry:profile`	Authenticated user’s profile
`get_transactions`	`biometry:transactions:read`	List transactions with filters
`get_transaction_sessions`	`biometry:transactions:read`	List transaction sessions
`get_transaction_by_id`	`biometry:transactions:read`	One transaction by id
`count_transactions`	`biometry:transactions:read`	Count matching transactions
`get_fraud_events`	`biometry:fraud:read`	List fraud detection events

Transaction tools accept filters including project_id, from_date, to_date, decision, status_code, device, location, user_fullname, session_id, and page / page_size. get_fraud_events also accepts rule, severity, and user. Queries default to your own project.

Verify

# Discovery metadata
curl -s https://mcp.biometrysolutions.com/.well-known/oauth-protected-resource

# Auth challenge
curl -i https://mcp.biometrysolutions.com/mcp        # 401 + WWW-Authenticate