> ## Documentation Index > Fetch the complete documentation index at: https://docs.storerocket.io/llms.txt > Use this file to discover all available pages before exploring further. # Connect an AI assistant (MCP) > Let Claude Code, Cursor and other MCP clients work on your locations and analytics with your API token. StoreRocket runs a remote [Model Context Protocol](https://modelcontextprotocol.io) server. An AI assistant connected to it can put your store locator on a website, add and update locations, and read your locator's analytics, using the same API token and permissions as the REST API. | | | | - | - | | Server URL | `https://storerocket.io/mcp` | | Transport | Streamable HTTP | | Authentication | Sign in (OAuth) or `Authorization: Bearer YOUR_TOKEN` | ## Create a token Open [API Tokens](https://storerocket.io/app/account/api-tokens) and create a token for your assistant. Tick what it may do: | Permission | Lets the assistant | | - | - | | See locations (`location:read`) | Find and read locations and categories, get the install code | | Add locations (`location:create`) | Add locations | | Edit locations (`location:update`) | Change locations | | Delete locations (`location:delete`) | Delete locations, one per call | | See analytics (`analytics:read`) | Read analytics: views, searches, searches that found nothing, clicks, leads | The token reaches the projects your user account belongs to, on a plan that includes the REST API. Revoke it from the same page at any time. ## Connect your client ```bash Claude Code theme={null} claude mcp add --transport http storerocket https://storerocket.io/mcp \ --header "Authorization: Bearer YOUR_TOKEN" ``` ```json Cursor (.cursor/mcp.json) theme={null} { "mcpServers": { "storerocket": { "url": "https://storerocket.io/mcp", "headers": { "Authorization": "Bearer YOUR_TOKEN" } } } } ``` Any MCP client that can send an `Authorization` header to a Streamable HTTP server can connect the same way. Keep the token out of shared repositories: in Cursor, use a user-level `~/.cursor/mcp.json`. ### Sign in instead of a token Clients that support MCP sign-in (OAuth 2.1), such as Claude, ChatGPT and Claude Code, need only the server URL. Add `https://storerocket.io/mcp` without a header; the client opens a StoreRocket page where you log in (or sign up) and press **Allow**. Allowing lets the assistant see, add and update your locations, read your analytics and get your install code, never your billing, plan, password or team. ```bash Claude Code theme={null} claude mcp add --transport http storerocket https://storerocket.io/mcp ``` Then run `/mcp` in Claude Code and choose **Authenticate**. | | | | - | - | | Discovery | `https://storerocket.io/.well-known/oauth-protected-resource/mcp` | | Client registration | Dynamic (`/oauth/register`), public clients; callback addresses of supported assistants or `http://localhost/callback` on any port | | Authorization | Authorization code with PKCE `S256` only (`plain` is refused); scope `mcp:use` | | Access token | 1 hour, refreshed for 90 days of use | To disconnect an assistant, open [API Tokens](https://storerocket.io/app/account/api-tokens): **Connected assistants** lists each one with **Disconnect**. Resetting your password disconnects every assistant. ## Tools Start with `list-projects`: every other tool takes a `project_id` from it (a 10-character id such as `Xn0pj9v86V`). Location tools take a `location_id` from `list-locations`. | Tool | Title | What it does | Permission | | - | - | - | - | | `list-projects` | Your store locators | Your projects: id, name, location count, status, plan | none | | `get-install-code` | Install code | The code that puts the locator on a website, placement steps, and whether it is live (last page seen in 30 days) | See locations | | `list-locations` | Find locations | Up to 100 per page, filtered by name, address, city, state, country or postal code; `include` adds hours, filters, fields or calls\_to\_action | See locations | | `get-location` | Location details | One location with hours, categories, custom fields and buttons | See locations | | `list-filters` | Location categories | Category (filter) names with how many locations carry each | See locations | | `create-locations` | Add locations | Add 1 to 50 locations; the answer lists created and refused, with reasons | Add locations | | `update-locations` | Update locations | Change 1 to 50 locations, each `{location_id, changes}`; only the fields sent change, as [PATCH](https://docs.storerocket.io/api/locations/update.md) does | Edit locations | | `delete-location` | Delete a location | Delete one location, permanently | Delete locations | | `get-analytics-overview` | Locator performance | Views, searches, searches with no results, clicks and leads for a date range, next to the period before | See analytics | | `get-top-searches` | Top searches | The most searched places and words, with how many found nothing | See analytics | | `get-searches-with-no-results` | Unmet demand | Where visitors searched and found no location nearby | See analytics | | `get-most-clicked-locations` | Most clicked locations | The most clicked locations, by kind of click (opened, directions, calls, emails, website, buttons) | See analytics | Every tool declares its title, an output schema, and whether it reads, writes or deletes (read-only, destructive, idempotent and open-world hints). Location tools call the [REST API](https://docs.storerocket.io/api/introduction.md): the same validation, geocoding and error messages. Analytics tools return the same numbers as Analytics in the dashboard. Dates are `YYYY-MM-DD` in UTC, up to 366 days per request, 30 days by default. Analytics count what visitors did on the locator, not sales or store visits. ## Prompts | Prompt | What it asks the assistant | | - | - | | `weekly-demand-review` | Review the last 7 days: the numbers against the week before, unmet demand, the most clicked locations, and a few actions | | `install-store-locator` | Put the locator on a page with `get-install-code`, then call it again to confirm it is live | ## Limits and errors * Requests share your REST API rate limit. Analytics tools also allow 30 requests a minute per person. * A refused call returns an MCP tool error with the reason, such as a missing permission, a plan without API access, or a project id that is not in your account. Another account's projects and locations are never returned. * `create-locations` and `update-locations` save each item on its own. When none could be saved, the error still lists every item and its reason. * `create-locations` without coordinates looks each address up while the request waits. For hundreds of rows, use an import or [Google Sheets sync](https://help.storerocket.io) in the dashboard. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.