# NachoNacho MCP server

> A Model Context Protocol server at https://mcp.nachonacho.com. It gives any MCP-compatible AI agent
> 9 tools: search the NachoNacho B2B SaaS and AI marketplace, issue and control virtual
> NachoCards, and report on spend. OAuth 2.1, no API key, and card numbers that never leave
> the app.

Endpoint: https://mcp.nachonacho.com
Page: https://nachonacho.com/mcp
About NachoNacho: https://nachonacho.com/llms.txt

## Connecting

The server is hosted; there is nothing to install or self-host. On first use the client
registers itself, opens NachoNacho in a browser, and the person approves the connection with
their existing account. No API key and no client secret exist to be issued.

### Clients that support remote MCP servers

Claude, Claude Code, Cursor and anything else that can add a server by URL. Point it at the endpoint — there is no API key to paste.

```json
{
  "mcpServers": {
    "nachonacho": {
      "url": "https://mcp.nachonacho.com"
    }
  }
}
```

### Clients that only run local servers

Use the standard mcp-remote bridge, which turns the hosted endpoint into a local stdio server.

```json
{
  "mcpServers": {
    "nachonacho": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://mcp.nachonacho.com"]
    }
  }
}
```

## Tools (9)

### Marketplace

_Open to every signed-in NachoNacho user._

- `search_products` — **Search the marketplace.** One query matched across name, descriptions, key benefits, features, pricing, eligibility and offers. Returns paginated summaries, each with a direct sign-up link.
- `get_product` — **Full product detail.** Everything on a product page by its slug: benefits, features, pricing, FAQs, media, reviews, categories, related products and social links — plus the link that redeems the deal.

### Spend management

_Shown only once the company is onboarded and approved for NachoCards._

- `find_my_nachocards` — **Find cards.** By nickname or last 4, across every company the user belongs to. Filter by status, virtual or physical, expired or not, and a creation date window.
- `create_nachocard` — **Issue a virtual card.** A new card for one subscription, optionally stamped with the marketplace deal it pays for and capped with a monthly limit in cents.
- `update_nachocard_status` — **Pause, resume or cancel.** Suspend a card reversibly, bring it back, or cancel it permanently — with a lost or stolen reason when that is what happened.
- `find_my_transactions` — **List settled spend.** Newest first, filtered by merchant, card, purchase or refund, amount range, date window, marketplace deal and whether cashback was earned. Paginated, with totals.
- `my_spend_summary` — **Total spend.** The same spend grouped by merchant, product, card or month, with cashback and transaction counts — one call instead of paging through charges and adding them up.

### Account

_Who the agent is acting for._

- `whoami` — **The authenticated user.** Name and email of the account behind the token, so an agent can say who it is signed in as.
- `my_companies` — **Companies and roles.** Every company the user belongs to and their role in each — what the other tools are scoped to.

## What you can ask for

Phrased the way a person asks, with the tools each request lands on.

### Find and buy software

- "Find me a transcription tool on NachoNacho and tell me what the discount is." — `search_products`
- "Compare the two cheapest CRM deals on the marketplace and link me the sign-up for the better one." — `search_products`, `get_product`
- "We need an email provider under $50 a month. What is on NachoNacho and what would it cost us?" — `search_products`, `get_product`

### Pay for it, with a limit

- "Issue a virtual card for that subscription, capped at $40 a month, and call it "Transcription"." — `create_nachocard`
- "Pause the card ending 4417 until I have spoken to the vendor." — `find_my_nachocards`, `update_nachocard_status`
- "We are not renewing Figma. Cancel its card." — `find_my_nachocards`, `update_nachocard_status`

### Know what it cost

- "What did we spend on SaaS last quarter, broken down by vendor?" — `my_spend_summary`
- "Which subscriptions went up in price in the last six months?" — `find_my_transactions`
- "How much cashback have we earned this year, and on which products?" — `my_spend_summary`

## Technical details

- **Endpoint:** https://mcp.nachonacho.com
- **Transport:** Streamable HTTP. Stateless — every request stands on its own, so there is no session to keep alive.
- **Protocol revisions:** 2026-07-28, 2025-11-25, 2025-06-18 and 2025-03-26. The current revision needs no initialize handshake; older clients get the handshake they expect.
- **Authentication:** OAuth 2.1, authorization_code + refresh_token, PKCE S256 required. Bearer token in the Authorization header.
- **Token lifetimes:** Authorization code 2 minutes, access token 1 hour, refresh token 30 days. The client refreshes on its own.
- **Client registration:** Dynamic (RFC 7591) at /oauth/register. Public clients: token_endpoint_auth_method is none, so there is no client secret.
- **Discovery:** RFC 9728 and RFC 8414 on the usual .well-known paths, plus iss on every authorization response (RFC 9207).
- **Scope:** A single mcp scope. The account you approve with is the account the agent acts as — it sees exactly what you see in the app, and nothing more.

## What the server will not do

- **Card numbers never cross the wire.** No tool returns a card number, expiry, CVC or PIN — not even to the agent that just created the card. Every card result carries a reveal link instead: the person opens it, signs in, and sees the details in their own browser.
- **The agent inherits your permissions.** Tools are scoped to the companies you belong to, through the same approved-only checks the app itself enforces. An agent cannot create a card the app would have refused.
- **Spend tools stay hidden until you qualify.** A user with no company approved for NachoCards is not offered the card tools at all, so an agent is never told it can spend money that it cannot.
- **Every card records where it came from.** A card created over MCP is stamped as such, and the stamp shows in the app, the API and your card list — so agent spend is never indistinguishable from a person clicking Create.

## FAQ

**What is the NachoNacho MCP server URL?** https://mcp.nachonacho.com. It speaks Streamable HTTP and is stateless, so a client points at that one endpoint with no session to keep alive. Clients without remote MCP support bridge to it with mcp-remote.

**Does the NachoNacho MCP server need an API key?** No. It uses OAuth 2.1 with authorization_code and refresh_token grants and PKCE S256, and registers clients dynamically (RFC 7591), so there is no API key or client secret to issue. The agent acts as the account that approved it and sees exactly what that account sees in the app.

**What can an AI agent do with NachoNacho over MCP?** 9 tools: search the marketplace and fetch full product detail, find cards, issue a virtual NachoCard for a subscription with a monthly limit, pause, resume or cancel a card, list settled transactions, summarise spend, and report which user and companies it is acting for.

**Can an AI agent see NachoCard numbers over MCP?** No. No tool returns a card number, expiry, CVC or PIN, not even to the agent that just created the card. Card results carry a reveal link instead, which the person opens and signs in to in their own browser.

**Which AI clients can connect to the NachoNacho MCP server?** Any MCP-compatible client. Claude, Claude Code and Cursor add it by URL (https://mcp.nachonacho.com); a client that only launches local servers connects through the mcp-remote bridge. There is nothing to install or self-host — the server is hosted by NachoNacho.

**How much does the NachoNacho MCP server cost?** The server itself costs nothing: it is part of a NachoNacho account, and there is no separate plan, key or quota for it. What an agent can do through it is whatever that account can already do in the app.

## Related

- [NachoPay](https://nachonacho.com/buyer/nachoPay): the virtual cards the spend tools issue, one per subscription.
- [Marketplace](https://nachonacho.com/marketplace): the catalogue `search_products` and `get_product` read from.
- [Full catalogue](https://nachonacho.com/llms-full.txt): every product with its discount, as one Markdown file.
- [Integrations](https://nachonacho.com/integrations): QuickBooks, Slack, Zapier and the Chrome extension.