Developers · REST API & MCP server

Built for agents.
Documented for humans.

The full test lifecycle — catalog, server-priced quotes, orders, payment, inbound shipping, published COAs, released raw data, and signed lifecycle webhooks — over a deterministic REST API and a stateless MCP server your AI agent can call directly.

POST /api/mcp /api/v1/agent GET /api/v1/openapi.json GET /api/ready

Open the OpenAPI 3.1 spec Create a scoped key

MCP tools

25+

REST endpoints

key scopes

payment rails

REST API · V1

A deterministic API for the full test lifecycle.

Cursor-paginated catalog, immutable 15-minute quotes, idempotent orders, payment state, tracking, and QA-published results — every commercial total in integer USD cents, described end to end by OpenAPI 3.1.

Base /api/v1/agent
Auth Authorization: Bearer gsa_live_…
Spec /api/v1/openapi.json

MCP SERVER · STREAMABLE HTTP

A safe path into the lab for AI agents.

The same tenant-isolated services as REST, exposed as 51 annotated MCP tools. Stateless JSON-only transport — initialize, ping, tools/list, tools/call — with discovery filtered to your key's scopes, so missing-scope tools stay invisible.

Endpoint POST /api/mcp
Protocol 2025-11-25 · stateless, no SSE
Registry com.goldstandardanalytics/lab-testing-commerce

Canonical order flow

Catalog → quote → order → COA.

Prices come from the server, never the client. A quote locks the price for 15 minutes; the order consumes it with an explicit confirmation and an idempotency key; results return only after QA publication.

POST /api/v1/agent/orders ● SERVER-PRICED

curl "$GSA_BASE/orders" \
  -H "Authorization: Bearer $GSA_AGENT_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: order-000001" \
  -d '{
    "quoteId": "QUOTE_UUID",
    "paymentMethod": "mercury_invoice",   # or stripe_checkout | usdc_erc20
    "sampleMetadata": [{
      "compoundName": "BPC-157",
      "lotNumber": "LOT-2026-0042"
    }],
    "publishRawData": true,
    "confirm": true
  }'

MCP tools

51 tools. 100% of the lifecycle.

Tool visibility follows the key: a scope your key doesn't carry makes its tools look unknown, preventing capability enumeration. Writes stay guarded by quotes, confirmation flags, and spend caps.

One-click connect

Add the lab to your agent.

Cursor and VS Code install the connector directly from this page. The rest take a paste — the config is prefilled and copied for you. Swap in your scoped key from the portal before the first call.

BEFORE YOU CONNECT Every config above carries the placeholder YOUR_GSA_AGENT_TOKEN. Create a scoped key in the portal and substitute it — keys are shown once and stored as a peppered HMAC. Create a key →

Connect your client

Two lines of config, most clients.

Authentication is a customer-scoped static bearer key created in the portal — shown once, stored as a peppered HMAC. Hosted Claude and ChatGPT connectors require the OAuth flow, which is on our roadmap.

{{ clientFile }} KEY STAYS IN YOUR SECRET STORE

{
  "mcpServers": {
    "Gold Standard Analytics": {
      "url": "https://www.goldstandardanalytics.com/api/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_GSA_AGENT_TOKEN"
      }
    }
  }
}

[mcp_servers.gold_standard_analytics]
url = "https://www.goldstandardanalytics.com/api/mcp"
bearer_token_env_var = "GSA_AGENT_TOKEN"

# export GSA_AGENT_TOKEN in the shell Codex starts from,
# restart Codex, then confirm with /mcp inside a session.

claude mcp add --transport http gold-standard-analytics \
  https://www.goldstandardanalytics.com/api/mcp \
  --header "Authorization: Bearer $GSA_AGENT_TOKEN"

# then inside a session: /mcp  →  tools/list shows only
# the tools your key's scopes allow.

export GSA_AGENT_TOKEN='gsa_live_REPLACE_ME'

curl -sS https://www.goldstandardanalytics.com/api/mcp \
  -H "Authorization: Bearer $GSA_AGENT_TOKEN" \
  -H "Content-Type: application/json" \
  -H "MCP-Protocol-Version: 2025-11-25" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

ALSO WORKS WITH HERMES AGENT, OPENCLAW, AND ANY STREAMABLE-HTTP MCP CLIENT · LISTED IN THE OFFICIAL MCP REGISTRY

Guardrails

A write-capable key is authorization, not intent.

Every layer assumes the agent can be wrong. Orders require a locked quote, an explicit confirm flag, and an idempotency key — and the key itself carries its own spending envelope.

Scopes

Grant exactly what the job needs.

Signed webhooks

Every lifecycle event, HMAC-signed.

Orders, invoices, payment stages, shipment events, sample receipt, testing start, COA publication, and COA retraction — delivered at-least-once with exponential backoff and a dead-letter state. Endpoints are SSRF-validated public HTTPS; secrets are AES-256-GCM encrypted and rotatable.

X-GSA-Signature: t=UNIX_SECONDS,v1=HEX_HMAC_SHA256
signed bytes:    UNIX_SECONDS.RAW_HTTP_BODY

dedupe on:       X-GSA-Event-Id / X-GSA-Delivery-Id

Payment rails

Mercury invoiceDEFAULT

Itemized invoice issued at order time; the shipping label emails automatically the moment payment lands.

Stripe CheckoutAGENT-MINTED

One tool call (gsa.payment.stripe.checkout) mints a single-use, amount-locked Checkout URL bound to the order — the agent hands it to a human to tap, or pays headlessly with an issued virtual card. Session expires with the quote; card details never transit the API, and payment.succeeded fires the same webhook + label flow as every rail.

Ethereum USDCNON-CUSTODIAL · ERC-20

Built for autonomous agents holding their own wallet: gsa.payment.usdc.request returns the ERC-20 transfer target and an exact six-decimal amount as the payment reference; the agent signs and broadcasts from its wallet, then posts the hash to gsa.payment.usdc.submit. We never hold a private key — hashes are verified against two independent RPC providers plus a finalized-log scanner before fulfillment runs.

Point your agent at the lab.

Create a scoped key, list the tools, and place your first server-priced order — the COA it returns is publicly verifiable like every other one we sign.

Create a scoped key Verify a COA

Built for agents.Documented for humans.