Connect an MCP client
Connect to https://kardilo.com/api/v1/mcp using Streamable HTTP and an Authorization: Bearer <ACCESS_TOKEN> header on every request. Start with partner credentials and exchange them for a token.
Prepare a valid token in KARDILO_ACCESS_TOKEN, then choose your client.
- Streamable HTTP
- Claude Code
- Codex
URL: https://kardilo.com/api/v1/mcp
Transport: Streamable HTTP
Authorization: Bearer <ACCESS_TOKEN>
Use these values in a client that accepts an explicit bearer header. Initialize the connection, then list the tools.
claude mcp add --transport http --scope user kardilo-catalog \
https://kardilo.com/api/v1/mcp \
--header "Authorization: Bearer ${KARDILO_ACCESS_TOKEN}"
This command stores the token value. Replace it after renewal, then reconnect from /mcp. Do not share this configuration.
[mcp_servers.kardilo_catalog]
url = "https://kardilo.com/api/v1/mcp"
bearer_token_env_var = "KARDILO_ACCESS_TOKEN"
Add this to ~/.codex/config.toml. The token must be in the Codex process environment. Restart after renewal.
Four read-only tools
| Tool | Input | structuredContent |
|---|---|---|
list_sets | zone?: intl, jp, chn | { sets: Set[] } |
list_cards | setCode; page? ≥1; pageSize? 1–200 | { page, pageSize, total, cards: Card[] } |
get_card | cardId | Card |
search_cards | query: 2–200 chars; zone?; setCode? ≤50 chars; limit? 1–100 | { cards: Card[] } |
Pagination defaults to page=1, pageSize=50. Search defaults to limit=25. list_cards also accepts a full set ID as setCode; search's setCode is a code filter.
Successful payloads appear in structuredContent and a JSON text block. Tool lookup failures set isError: true. Check that flag before using results; invalid arguments can instead produce a protocol error.
Verify the connection
Initialize the connection and discover the four tools. Call list_sets, select a returned set identifier, then list_cards and get_card with returned identifiers.
Try: “Find the international catalogue entries matching Charizard 4. Show each set, language, printing and available scan URL.”
Renewal and compatibility
The endpoint is stateless. A plain authenticated GET returns 405, not a health result. Every request needs a valid token. Renew using expires_in, update your client's token and reconnect when needed. A client supporting only browser OAuth sign-in is not compatible with this client-credentials setup.