Satelit MCP server

Endpoint and protocol

One endpoint for both eras of the protocol. No SSE stream and no Mcp-Session-Id: every request is complete on its own.

2026-07-28, stateless

• A request that carries _meta["io.modelcontextprotocol/protocolVersion"] is in the new era.
• The headers MCP-Protocol-Version and Mcp-Method must equal the body, and Mcp-Name the tool on tools/call (=?base64?…?= is decoded). Otherwise 400 -32020.
• Another version: 400 -32022 with supported.
• Results carry resultType: "complete" and _meta["io.modelcontextprotocol/serverInfo"]. server/discover and tools/list carry ttlMs and cacheScope: public.

2025-11-25, 2025-06-18, 2025-03-26

• initialize answers the version asked for when it knows it, otherwise 2025-11-25.
• notifications/* get 202, ping gets {}.
• The MCP-Protocol-Version header, when present, must be one of these versions.

Everything else

• Unknown method: -32601 (404 in the new era). Unknown tool: -32602. A batch: 400.
• GET and DELETE: 405 with Allow. An Origin that is neither https nor this machine: 403.
• resources/list and prompts/list answer empty lists.

curl https://api.satelit.md/mcp \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -H "MCP-Protocol-Version: 2026-07-28" \
  -H "Mcp-Method: tools/call" \
  -H "Mcp-Name: search_prices" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"search_prices","arguments":{"query":"lapte 2.5%","lang":"en"},"_meta":{"io.modelcontextprotocol/protocolVersion":"2026-07-28"}}}'

curl https://api.satelit.md/mcp \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-11-25","capabilities":{},"clientInfo":{"name":"my-app","version":"1.0"}}}'

Sign-in: OAuth 2.1

Without a token the handshake, ping and tools/list answer, and a few price searches a day work (see the plans). Any other call, or the taste used up, answers 401 with WWW-Authenticate and the address of the resource metadata: that is where the client's sign-in starts (lazy authentication). With a token: Authorization: Bearer, made for this server and checked on every request; a token for something else is 401, one without the mcp scope 403 insufficient_scope. tools/list marks each tool's securitySchemes.

Metadata

• Protected resource (RFC 9728): https://api.satelit.md/.well-known/oauth-protected-resource/mcp, and without /mcp.
• Authorization server: https://app.satelit.md, with /.well-known/oauth-authorization-server and /.well-known/openid-configuration.
• Code flow with PKCE S256 only. Scopes: mcp offline_access; openid is optional.

How an app registers

• Client ID Metadata Documents: a client_id that is an https address with a path. We fetch it (public addresses, port 443, 5 s, 32 KB, no redirect); it must name itself and not carry the Satelit name. token_endpoint_auth_method: none, or private_key_jwt with a jwks_uri on the same host. Read again after 24 hours.
• Dynamic registration (RFC 7591): POST https://app.satelit.md/api/oauth/register with redirect_uris. https addresses, or http on localhost, never a Satelit host. 10 an hour from one address. An app nobody approved within 7 days is deleted.
• An app on a computer may use any port of its registered loopback address (RFC 8252 7.3).

Tokens bound to the server

• resource (RFC 8707) on authorize and token: only https://api.satelit.md/mcp, otherwise invalid_target. The mcp scope without resource means the same resource.
• The access token's aud is the server's address: it opens nothing else, userinfo included.
• Access outlives the browser session: signing out of the website does not disconnect the app. It ends when the person disconnects it in Settings, under Connected apps, when the account is disabled or deleted, or after 60 days unused.

The consent screen names the host the code goes to (chatgpt.com, claude.ai, 127.0.0.1), what the app can do and what never crosses.

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer
  resource_metadata="https://api.satelit.md/.well-known/oauth-protected-resource/mcp",
  scope="mcp offline_access"

{
  "resource": "https://api.satelit.md/mcp",
  "authorization_servers": [
    "https://app.satelit.md"
  ],
  "scopes_supported": [
    "mcp",
    "offline_access"
  ],
  "bearer_methods_supported": [
    "header"
  ],
  "resource_name": "Satelit",
  "resource_documentation": "https://developer.satelit.md/en/mcp/",
  "resource_policy_uri": "https://satelit.md/en/privacy/",
  "resource_tos_uri": "https://satelit.md/en/terms/"
}

Structured answers

A refusal is a result with isError: true and a body the AI app can tell the person. The conversation goes on. No price and no promotion in answers.

• plan_requiredthe tool needs a higher plan: needed_plan, your_plan, adds, plans_page, message.
• limit_reacheda limit: limit (minute, day, writes, distinct, pool, pages, watches), retry_after_s, then next_plan, adds, plans_page, or bulk (the API) past the top plan.
• morethe plan cut a list: shown, found, next_plan, plans_page. Absent when nothing was cut.
• search_firstan id that did not come from one of the person's searches today.
• confirm_emailthe account's e-mail address is not confirmed.

{
  "status": "plan_required",
  "needed_plan": "Satelit Family",
  "your_plan": "Satelit Free",
  "adds": [
    "…"
  ],
  "plans_page": "https://satelit.md/en/pricing/",
  "message": "…"
}

{
  "query": "lapte 2.5%",
  "currency": "MDL",
  "page": 1,
  "pages": 1,
  "products": [
    "…"
  ],
  "found": 48,
  "more": {
    "shown": 5,
    "found": 48,
    "message": "…",
    "next_plan": "Satelit Family",
    "plans_page": "…"
  }
}

Client configuration

ChatGPT, Claude, Perplexity and Gemini take the address in their settings, then open the Satelit sign-in. Editors and command lines:

Install in Cursor Install in VS Code

Try it

A call that needs an account answers 401 with the metadata's address: from there any client signs in. MCP Inspector and claude mcp add go the whole way.

claude mcp add --transport http satelit https://api.satelit.md/mcp

gemini mcp add --transport http satelit https://api.satelit.md/mcp

{
  "mcpServers": {
    "satelit": {
      "url": "https://api.satelit.md/mcp"
    }
  }
}

{
  "servers": {
    "satelit": {
      "type": "http",
      "url": "https://api.satelit.md/mcp"
    }
  }
}