MCP, REST & auth
54 MCP tools, Streamable HTTP, REST v1 and OAuth 2.1.
VeloStack offers three integration paths: VeloConnect for ERP systems, REST for custom applications and MCP for AI clients.
MCP
The MCP endpoint is at /mcp and speaks Streamable HTTP (MCP spec 2025-06-18), stateless. Auth via bearer token: API token, OIDC JWT or OAuth 2.1 token.
Tool groups
| Group | Count |
|---|---|
| Catalog | 24 |
| Mapping | 13 |
| Sync / stats | 6 |
| Admin | 2 |
| Receipts | 5 |
| Quality / sourcing / supplier terms | 4 |
OAuth 2.1
The built-in authorization server supports discovery, dynamic client registration (RFC 7591), PKCE-S256, refresh-token rotation with replay detection and revocation (RFC 7009). Tokens work on /mcp and /api/v1 in parallel.
REST v1
The REST API is at /api/v1, documents itself via OpenAPI/Swagger and uses bearer tokens (vcapi_…) or OIDC JWT. Scopes: read and write.
curl https://veloconnect.velostack.eu/health
curl -H "Authorization: Bearer vcapi_..." \
https://veloconnect.velostack.eu/api/v1/models?limit=10