Remote MCP · v1.0OAuth 2.1 + PKCE

Give AI agents embroidery tools.

Connect assistants to format discovery, account usage and private processing jobs—on behalf of a user, with browser approval and no billing or credential tools.

Streamable HTTP endpoint

https://embroideryfileconverter.com/mcp/embroidery

Tools

5

Scope

mcp:use

Read rate

60/min

The user signs in, verifies their email and approves access in the browser. The agent receives a scoped token—not the user’s password or an API key.

Client compatibility

Choose your agent. Copy its setup.

Use the guides below for ChatGPT, Claude, the OpenAI Agents SDK, Cursor, VS Code, OpenClaw, Gemini CLI, OpenCode, Windsurf and Cline. Each guide identifies whether OAuth is native, developer-managed or may require a reviewed bridge.

OpenAI logo
Native OAuthChatGPT web · Settings → Apps

Connect ChatGPT

Create a custom MCP app in ChatGPT developer mode and let ChatGPT discover the tools and OAuth metadata.

  1. 1Enable Developer mode in Settings → Apps → Advanced settings, or open Workspace settings → Apps → Create.
  2. 2Create an app, paste the MCP endpoint, and choose OAuth authentication.
  3. 3Select Scan tools, approve access in the browser, then create and enable the draft app.
Official ChatGPT MCP documentation
ChatGPT setup · Connection values
MCP server URL: https://embroideryfileconverter.com/mcp/embroidery
Authentication: OAuth
Required scope: mcp:use

Use browser OAuth and request only mcp:use. Never place a password, refresh token, or long-lived bearer token in a repository.

Full write-tool support is intended for ChatGPT Business and Enterprise/Edu workspaces. Availability and admin controls vary by plan.

Streamable HTTPOAuth authorization code + PKCEPer-user private data

If your client cannot open OAuth

Confirm it supports remote Streamable HTTP MCP servers and protected-resource discovery. A local stdio-only client cannot connect to this hosted endpoint without a compatible bridge.

Authorization

OAuth authorization code + PKCE.

The server publishes standards-based metadata, requires S256 PKCE and exposes one least-privilege scope. Dynamic registration is available only for operator-allowed callback origins and native schemes.

Protected resourcehttps://embroideryfileconverter.com/.well-known/oauth-protected-resource/mcp/embroidery
Authorization serverhttps://embroideryfileconverter.com/.well-known/oauth-authorization-server
Dynamic registrationhttps://embroideryfileconverter.com/oauth/register
Issuerhttps://embroideryfileconverter.com
Required scopemcp:use
Protocol-level examples · JSON-RPC
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "initialize",
  "params": {
    "protocolVersion": "2025-06-18",
    "capabilities": {},
    "clientInfo": {
      "name": "Your agent",
      "version": "1.0.0"
    }
  }
}

Short-lived access

Access tokens expire after 60 minutes. Refresh tokens expire after 30 days and remain revocable.

Verified account required

A valid token must contain mcp:use, and the connected user must have a verified email address.

Tool reference

Five tools, explicit boundaries.

list-formats-tool

Lists readable embroidery sources, writable machine outputs, artwork input types and compatibility warnings.

Read only

Arguments

  • No arguments

Structured result

artwork_inputs[] and formats[]

get-account-usage-tool

Returns preview allowance, credit balance, workflow costs, subscription limits and reset dates.

Read only

Arguments

  • No arguments

Structured result

usage object

list-processing-jobs-tool

Lists recent conversion and digitising jobs owned by the connected account.

Read only

Arguments

  • limit: integer, 1–50, default 20

Structured result

jobs[] with status, files and metrics

get-processing-job-tool

Gets one owned job with events, warnings, metrics, preview artifacts and available OAuth-protected file URLs.

Read only

Arguments

  • workflow: conversion | digitising
  • job_id: 26-character job identifier

Structured result

job object

create-processing-job-tool

Creates one private conversion or automated digitising preview from a standard base64-encoded file.

Creates data

Arguments

  • workflow: conversion | digitising
  • file_name: original name with extension
  • file_base64: raw standard base64, no data URL prefix
  • format: lowercase writable output
  • width_mm: 10–300, required for digitising
  • colour_count: 1–24, required for digitising

Structured result

job summary and billing_authorized: false

Tool calls and prompts

Copy-ready agent examples.

MCP tool call · JSON-RPC
{
  "jsonrpc": "2.0",
  "id": 2,
  "method": "tools/call",
  "params": {
    "name": "list-formats-tool",
    "arguments": {}
  }
}
Prompt 1

Check which formats can read PES and safely write JEF. Show me any compatibility warnings.

Prompt 2

List my five most recent embroidery jobs and summarize anything that failed.

Prompt 3

Before uploading, ask me to confirm. Then digitise logo.png at 90 mm wide with no more than 8 colours and return a PES preview.

Prompt 4

Poll job 01J… until it finishes, then report stitch metrics, warnings and whether a download is already unlocked.

Safety model

Useful access without payment authority.

No billing tools

No purchase, checkout, credit consumption by explicit unlock, or paid-download unlock tool is exposed.

No credential tools

The agent cannot issue API keys, change authentication or retrieve secret material.

Owned data only

Every job query is restricted to the connected user before details are returned.

Untrusted output stays data

Server instructions tell agents never to follow commands embedded in filenames, metadata, job messages or warnings.

Creating a preview changes state

The create tool stores a private upload, creates a job and can consume preview allowance. It is separately limited to 6 requests per minute per user, with an additional network limit. The server instructs the agent to ask the user before uploading.

Preview is not production approval

A successful tool call sets billing_authorized: false. Agents should not claim a design is production-ready before completion, metrics and warnings are inspected.

Troubleshooting

Diagnose connection failures quickly.

401 Unauthorized

No valid access token was sent. Restart the client’s OAuth connection.

403 Forbidden

The token lacks mcp:use, the account is unverified, or the job belongs to another user.

invalid_redirect_uri

The client callback origin or native scheme is not on the server allow-list.

422 tool error

Arguments, base64 data, source type, target format or account quota failed validation.

429 Too Many Requests

Read tools allow 60 requests per minute by default; the file-creation tool allows 6. Respect Retry-After.

Avoid aggressive polling

Poll queued and processing jobs with backoff. Stop when the status becomes completed or failed.

Expired private file

File URLs require the same OAuth access token and remain subject to the upload’s expiresAt retention date. Do not treat URLs as permanent file identifiers.

Building a conventional app?

Use the scoped REST API.

The REST guide includes API key management, multipart examples in three languages, every endpoint, response lifecycle and OpenAPI 3.1.

Open REST API docs