Swarmtix MCP Server

Server URL

https://swarmtix.com/mcp/v1

Protocol

2026-07-28, 2025-11-25, 2025-06-18, 2025-03-26, 2024-11-05

Auth

OAuth 2.1 authorization code with PKCE (S256). No API key.

Transport

Streamable HTTP, JSON-RPC 2.0. One endpoint for stateful and stateless clients.

Tools

47 — 19 read, 28 write. No refunds, check-in or bulk email. Publish and unpublish need the separate events:publish scope. The only deletes are an unsold ticket type, switching off a discount or a checkout question, and parts of an unpublished online event's program.

Tenancy

One token, one organisation. The organisation comes from the token, never from a parameter.

This page is the dense version of /mcp, written to be read by a program. Prose documentation is at /docs/mcp/.

Connect

Each block below is complete on its own. Take the one for your client; you do not need to read the others. Every path ends the same way: a browser opens a Swarmtix consent page, you approve, and the tools appear.

Claude (web and desktop)

Settings → Connectors → Add custom connector. Paste this URL, click Add, then Connect.

https://swarmtix.com/mcp/v1

ChatGPT

Settings → Connectors → create a connector. Paste this URL, choose OAuth, leave any API key field empty, then Connect. ChatGPT's redirect URIs are allowed explicitly, so nothing needs registering first.

https://swarmtix.com/mcp/v1

Claude Code

claude mcp add --transport http swarmtix https://swarmtix.com/mcp/v1

Add --scope user for every project rather than the current one. Then run /mcp inside Claude Code, pick swarmtix, and authenticate.

VS Code

Write .vscode/mcp.json in the workspace, or the same block in the user configuration for every workspace.

{
  "servers": {
    "swarmtix": {
      "type": "http",
      "url": "https://swarmtix.com/mcp/v1"
    }
  }
}

Cursor

Write .cursor/mcp.json in the project, or ~/.cursor/mcp.json for every project. Then Settings → MCP and sign in.

{
  "mcpServers": {
    "swarmtix": {
      "url": "https://swarmtix.com/mcp/v1"
    }
  }
}

Raw HTTP

JSON-RPC 2.0 over Streamable HTTP. Every call is a POST to the same URL. On 2026-07-28 the MCP-Protocol-Version, Mcp-Method and Mcp-Name headers are mandatory and must agree with the body; a header that contradicts the body is refused with JSON-RPC error -32020.

curl -X POST https://swarmtix.com/mcp/v1 \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "MCP-Protocol-Version: 2026-07-28" \
  -H "Mcp-Method: tools/list" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

You do not select a session mode. A client that opens with initialize is given a session; a 2026-07-28 client is served statelessly. Same endpoint, both work.

End-to-end example

Discovery, authorization, then a call. Nothing here needs a credential you were given out of band.

1. Discover

An unauthenticated call names the metadata document.

curl -i -X POST https://swarmtix.com/mcp/v1 \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer resource_metadata="https://swarmtix.com/.well-known/oauth-protected-resource", scope="events:read"

Fetch that document. It names the authorization server, whose own metadata gives the endpoints below.

2. Authorize

Register with Dynamic Client Registration (RFC 7591) or identify yourself with a Client ID Metadata Document — both are supported. Then run the authorization code flow. The resource parameter (RFC 8707) is echoed into aud, and the authorization response carries iss (RFC 9207).

GET https://swarmtix.com/connect/authorize
  ?response_type=code
  &client_id=YOUR_CLIENT_ID
  &redirect_uri=YOUR_REDIRECT_URI
  &scope=events:read%20orders:read
  &resource=https://swarmtix.com/mcp/v1
  &code_challenge=BASE64URL_SHA256_OF_VERIFIER
  &code_challenge_method=S256
  &state=OPAQUE

POST https://swarmtix.com/connect/token
  grant_type=authorization_code
  &code=RETURNED_CODE
  &redirect_uri=YOUR_REDIRECT_URI
  &client_id=YOUR_CLIENT_ID
  &code_verifier=YOUR_VERIFIER
  &resource=https://swarmtix.com/mcp/v1

The user sees a top-level consent page, never an iframe — X-Frame-Options: SAMEORIGIN is set. Do not forward a Swarmtix access token to any other service, and do not present a token issued for a different audience; the server validates that a token was issued for this resource.

3. Call

curl -X POST https://swarmtix.com/mcp/v1 \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "MCP-Protocol-Version: 2026-07-28" \
  -H "Mcp-Method: tools/call" \
  -H "Mcp-Name: swarmtix_events_list" \
  -d '{
        "jsonrpc":"2.0",
        "id":2,
        "method":"tools/call",
        "params":{"name":"swarmtix_events_list","arguments":{"limit":50}}
      }'

tools/list returns only the tools your approved scopes cover. A tool you were not granted is absent from the list rather than failing on call.

Tools

47 tools. Every one declares all four MCP annotations explicitly. All are openWorldHint: false except swarmtix_event_images_set, swarmtix_speakers_create and swarmtix_speakers_update, which fetch an image from a URL you give them. Reads are readOnlyHint: true, idempotentHint: true; eight tools are destructiveHint: true: swarmtix_ticket_types_delete, swarmtix_checkout_questions_delete, swarmtix_discounts_delete, swarmtix_events_unpublish, swarmtix_online_categories_delete, swarmtix_speakers_delete, swarmtix_talks_delete and swarmtix_hosts_delete. Full per-tool reference, with parameters and worked examples, is at /docs/mcp/tools.

Scopes

Ten. Request only what the task needs; the user sees each one in plain English before approving. Scopes gate tool visibility, not just invocation.

Limits and behaviour

Errors

Errors are sentences with stable leading phrases, so you can match on them. A cross-tenant record returns the same message as a genuinely missing one, by design.

<n> in the rate-limit message is the same integer as the Retry-After header.

Not available

No tool exists for any of these, and no combination of the tools that do exist produces them. Asking differently will not help.

• Refunds and charges
• Check-in and barcode scanning
• Bulk attendee email
• Guest-list import
• Deleting an event, an order or an attendee
• Account closure and subscription changes
• Registering a webhook
• Reading or writing billing, payout or account settings

An assistant can prepare an event completely. It cannot launch it, spend money, or contact the organiser's attendees.

Resources and prompts

Beyond tools, the server exposes two resources you can attach as context without a tool call, and four workflow prompts. Both resources are templated, so they are listed by resources/templates/list — resources/list covers parameterless URIs and is empty here.

Sampling, elicitation and roots are deliberately not implemented. All three are deprecated in 2026-07-28; no tool needs them.

More

• MCP documentation — overview, per-client setup, scopes, and a page per tool
• Connecting — the same client setups in prose, with troubleshooting
• Authentication and scopes — the consent flow, lifetimes, and revocation
• MCP server overview — the same thing written for a person
• MCP integration page — setup steps and FAQs
• llms.txt — index of the whole site for language models
• Privacy policy and terms of use

Support: [email protected]