MCP for AI tools

SlipBolt runs an MCP server (Model Context Protocol) so the AI you already code with can talk to SlipBolt directly — no pasting docs into the chat, no guessing endpoint names.

https://docs.slip-bolt.com/mcp

Try asking your AI:

• "Write an Express endpoint that takes a slip from a customer and closes the order, following the SlipBolt docs"
• "Did the slip with reference 015170106978BTF01234 pass? Give me the receipt code and check link"
• "How much quota is left this month?"

1. Create an API key

Go to Settings → API Keys (app.slip-bolt.com/settings/api-keys) and create a key.

• Use sk_test_ while developing · switch to sk_live_ for the shop's real data
• Tick only the read scope if the AI only needs to read — it then cannot verify new slips (which uses quota), however hard it tries
• Keep the key in an environment variable called SLIPBOLT_API_KEY — never paste the key into a chat with an AI

export SLIPBOLT_API_KEY="sk_test_xxxxxxxxxxxxxxxx"

Docs only (no shop data)? Skip this step and configure without the header.

2. Configure your AI tool

The key goes in the Authorization: Bearer sk_… header only — keys in the URL are not accepted (URLs end up in logs at every hop).

Claude Code

Quick — one command (the key is stored in ~/.claude.json on your machine):

claude mcp add --transport http slipbolt https://docs.slip-bolt.com/mcp \
  --header "Authorization: Bearer $SLIPBOLT_API_KEY"

Shared with your team — put .mcp.json at the project root. It is safe to commit because it holds no key: Claude Code reads ${SLIPBOLT_API_KEY} from each person's environment when it connects.

{
  "mcpServers": {
    "slipbolt": {
      "type": "http",
      "url": "https://docs.slip-bolt.com/mcp",
      "headers": { "Authorization": "Bearer ${SLIPBOLT_API_KEY}" }
    }
  }
}

Check it: type /mcp in Claude Code — you should see slipbolt with 9 tools.

Cursor

Edit ~/.cursor/mcp.json (all projects) or .cursor/mcp.json (this project only):

{
  "mcpServers": {
    "slipbolt": {
      "url": "https://docs.slip-bolt.com/mcp",
      "headers": { "Authorization": "Bearer ${env:SLIPBOLT_API_KEY}" }
    }
  }
}

Launch Cursor from a terminal where SLIPBOLT_API_KEY is exported (or set it system-wide), then check Settings → MCP.

Claude Desktop

Claude Desktop cannot send custom headers to a remote MCP server by itself ⇒ use mcp-remote as a bridge (needs Node.js 18+). Edit claude_desktop_config.json (Settings → Developer → Edit Config) and restart Claude Desktop:

{
  "mcpServers": {
    "slipbolt": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://docs.slip-bolt.com/mcp", "--header", "Authorization:${SLIPBOLT_AUTH}"],
      "env": { "SLIPBOLT_AUTH": "Bearer sk_test_xxxxxxxxxxxxxxxx" }
    }
  }
}

• Authorization:${SLIPBOLT_AUTH} has no space after : on purpose — Claude Desktop on Windows splits arguments containing spaces incorrectly
• The key lives in this file on your machine — don't share the file
• Docs only: Settings → Connectors → Add custom connector with the URL https://docs.slip-bolt.com/mcp — no mcp-remote needed

Other clients

Any client that supports Streamable HTTP takes the same two values: URL https://docs.slip-bolt.com/mcp + header Authorization: Bearer <key>. Clients that only speak stdio can use mcp-remote the same way as Claude Desktop.

3. All tools

• verify_slip is the only tool declared as not read-only — most clients ask you before calling it
• qr (the text inside the slip's QR code) is the cheapest and fastest · imageBase64 fits about 3.5 MB (the whole request must stay under 5 MB)
• You can pass idempotencyKey (e.g. the order id) — an AI that retries after a timeout with the same value gets the original result, not verified or charged again (Idempotency-Key)
• Sending the same image again within 24 h returns the same result without using quota — same Idempotency as the REST API
• A passing slip (status: "SUCCESS", verified: true) may still carry errorCode: "STALE_SLIP" (and warnings: [{ code: "STALE_SLIP" }]) — this is a warning that the slip is genuine but the bank transfer timestamp is over 24 h old, not a rejection (see Stale slip)
• sk_test_ keys don't use the shop's quota but have their own ceiling; past it you get 402 TEST_QUOTA_EXCEEDED

4. Try it with cURL

MCP is plain JSON-RPC over HTTP POST — you can try it without an AI:

# List tools (no key needed)
curl -s https://docs.slip-bolt.com/mcp \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

# Call get_quota with your shop's key
curl -s https://docs.slip-bolt.com/mcp \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "Authorization: Bearer $SLIPBOLT_API_KEY" \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"get_quota","arguments":{}}}'

The tool output is in result.content[0].text (JSON) · failures come back as result.isError: true with a message saying what to fix.

5. Security

• The key travels only in each request's header — we don't store it, don't log it, and don't accept it via the URL or tool arguments
• The server is stateless: every request stands alone, no lingering sessions
• Other websites cannot call /mcp from a browser (the Origin is checked · 403)
• Give the AI a read-only key unless it really needs to verify new slips · revoke keys any time at Settings → API Keys (takes effect on MCP immediately)
• Tool results contain your shop's slip data (payer name · partial account numbers) — some AI tools send chat content to their own provider, see Security & PDPA

6. Troubleshooting