Sessions MCP

Sessions ships one MCP surface with four servers behind it — build-time schema tools, public discovery and checkout, staff administration, and agentic commerce. Every server speaks Streamable HTTP over the Model Context Protocol, so any MCP client connects with just a URL — no SDK, nothing to install.

TransportStreamable HTTPServers4AuthNone → OAuth 2.1

Pick your server

Every server speaks the same protocol; pick by audience — each card opens that server's full guide.

Public MCP guideDiscovery and checkout over the public surface — find businesses, browse schedules, price a checkout, start sign-in. Works anonymously; signing in unlocks the viewer tools.sessions-publicoptional sign-ingo.sessions.website/api/mcp Business MCP guideStaff tools against one business — attendance, stats, creating and cancelling sessions. Always authenticated over OAuth with your real staff permissions.sessions-businessOAuthbusiness.sessions.website/@<handle>/api/mcp UCP via MCPCheckout for shopping agents over the Universal Commerce Protocol's MCP binding — carts, pricing, and completion.sessions-ucpoptional sign-ingo.sessions.website/@<handle>/api/ucp/mcp

Building the integration itself? sessions-dev at go.sessions.website/build/api/mcp searches the GraphQL schemas and validates documents — no auth, no guide needed; every server is catalogued in mcp.json.

Tool reference

Every tool on every server — its parameters, what it returns, and a call you can paste into a terminal. Generated from the shipped tool definitions, so it cannot drift from what the servers register.

Sessions developer docs (4)Sessions public API (7)Sessions business API (9)Sessions agentic checkout (UCP) (5)

Connect your client

Copy-paste setup for the most common agent clients. Every snippet below connects the public server — the right default for most agents.

Which URL?

Keep go.sessions.website/api/mcp for discovery and consumer tasks. Swap in go.sessions.website/build/api/mcp while you're building an integration, or business.sessions.website/@<handle>/api/mcp to act as staff on your own business — the setup is otherwise identical.

Claude

In Claude on the web or desktop, open Settings → Connectors → Add custom connector, name it Sessions, and paste the endpoint URL.

connector URL

https://go.sessions.website/api/mcp

That's it for the public tools. For the business server, paste its URL instead — Claude walks you through the OAuth sign-in the first time it connects.

Claude Code

Add the server from your terminal — it's available in every project immediately. For the business server, run /mcp inside Claude Code afterwards to complete the OAuth sign-in.

terminal

claude mcp add --transport http sessions https://go.sessions.website/api/mcp

# Acting as staff on your business? Add the OAuth-gated server too:
claude mcp add --transport http sessions-business \
  https://business.sessions.website/@<handle>/api/mcp

Prefer a richer setup? The Sessions plugin wires up all the servers at once, plus skills that teach the agent the whole API:

terminal

claude plugin marketplace add SessionsCode/ai-toolbox
claude plugin install sessions@ai-toolbox

Cursor

Add the server to .cursor/mcp.json in your project — or ~/.cursor/mcp.json to make it global — then enable it under Settings → MCP. Cursor supports MCP OAuth, so the business server prompts for sign-in on first use.

.cursor/mcp.json

{
  "mcpServers": {
    "sessions": {
      "url": "https://go.sessions.website/api/mcp"
    }
  }
}

Codex

Declare the server in ~/.codex/config.toml. Recent Codex releases speak Streamable HTTP natively; on older versions, also set experimental_use_rmcp_client = true.

config.toml

# ~/.codex/config.toml
[mcp_servers.sessions]
url = "https://go.sessions.website/api/mcp"

Windsurf

Add the server to ~/.codeium/windsurf/mcp_config.json, then refresh the server list from Windsurf's MCP panel.

mcp_config.json

{
  "mcpServers": {
    "sessions": {
      "serverUrl": "https://go.sessions.website/api/mcp"
    }
  }
}

Authentication

The dev server needs nothing. The public and UCP servers work anonymously and act as the signed-in viewer once a token is present. The business server always requires OAuth.

OAuth is automatic

Clients that support MCP authorization discover the whole flow themselves: the server challenges with a 401 pointing at /.well-known/oauth-protected-resource, the client self-registers over Dynamic Client Registration (POST /oauth/register), and you approve access on the consent screen. There is no API key to create or paste.

The handshake — discovery, registration, PKCE, consent, scopes — is shared across every Sessions MCP server. OAuth reference

discovery

# An unauthenticated request is challenged:
HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer resource_metadata=
  "https://business.sessions.website
     /.well-known/oauth-protected-resource"

Keep going

The machine-readable catalogue and the rest of the agent toolkit:

Agent toolkit View mcp.jsonOAuth reference