Model Context Protocol

Give your agent a safe path into the lab.

The GSA MCP server exposes the same tenant-isolated commerce and result services as REST, with scope-filtered discovery, mutation guards, spend controls, and published-only result reads.

Choose your client Create a scoped key

Connection

https://www.goldstandardanalytics.com/api/mcp

Transport is stateless Streamable HTTP (JSON responses) over HTTPS. The server implements initialize, ping, tool discovery and calls, reference resources (quickstart, webhook signing, the OpenAPI contract), and guided prompts(order-testing, verify-coa, track-order). Discovery filters tools by the key's scopes; event-specific read scopes for webhook creation are enforced when that tool is called.

Two auth paths. Hosted connectors (claude.ai, Claude Desktop, ChatGPT, and any OAuth-capable client) onboard with just the endpoint URL — the server implements OAuth 2.1 authorization-code + PKCE with dynamic client registration, and tokens map onto the same scoped, spend-capped key model. CLIs and editors can instead send a static, revocable gsa_live_… bearer key. Never put a real key in an install URL; the one-click links here carry only the endpoint.

Client setup

Connect any agent in under a minute

The server speaks both auth paths: OAuth 2.1 with dynamic client registration — hosted connectors (claude.ai, ChatGPT) need only the endpoint URL — and scoped API keys for CLIs and editors. Endpoint: https://www.goldstandardanalytics.com/api/mcp

Claude (claude.ai, Desktop, Code, API)

OAuth one-click + API key

Hosted Claude connects with just the URL via OAuth. Claude Code takes one command. The Claude API attaches the server per-request with the MCP connector.

claude.ai / Claude Desktop

Settings → Connectors → Add custom connector.
Paste https://www.goldstandardanalytics.com/api/mcp and click Add. The OAuth sign-in and consent screen run automatically — no key to paste.
Enable the connector's tools from the chat composer's tools menu.

Hosted Claude connector guide

Claude Code

One command. Keep the header for key-based auth, or drop it to use the OAuth flow (/mcp then authenticate).

Terminal

claude mcp add --transport http gold-standard-analytics \
  "https://www.goldstandardanalytics.com/api/mcp" \
  --header "Authorization: Bearer YOUR_GSA_AGENT_TOKEN"

Claude Code MCP guide

Claude API (MCP connector)

Add this block to a Messages request (beta header anthropic-beta: mcp-client-2025-04-04).

Messages API request body

{
  "mcp_servers": [
    {
      "type": "url",
      "url": "https://www.goldstandardanalytics.com/api/mcp",
      "name": "gold-standard-analytics",
      "authorization_token": "YOUR_GSA_AGENT_TOKEN"
    }
  ]
}

ChatGPT + OpenAI API

OAuth one-click + API key

ChatGPT custom connectors onboard via OAuth with just the URL. The Responses API / Agents SDK attaches the server per-request with a scoped key.

ChatGPT connectors

Settings → Connectors → Advanced → Add custom connector (developer mode where required).
Name it and paste https://www.goldstandardanalytics.com/api/mcp. ChatGPT discovers the OAuth server and walks through sign-in and consent.
Pick the connector from Tools in the composer.

ChatGPT connection flow

Responses API / Agents SDK

Responses API request body

{
  "tools": [
    {
      "type": "mcp",
      "server_label": "gold_standard_analytics",
      "server_url": "https://www.goldstandardanalytics.com/api/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_GSA_AGENT_TOKEN"
      },
      "require_approval": "always"
    }
  ]
}

Cursor

One-click install

The install link carries only the endpoint URL; Cursor then runs the OAuth flow. Prefer a static key instead? Use the manual mcp.json below.

Add to Cursor (app)Add to Cursor (web)

Click an install link and approve the server in Cursor's dialog.
Complete the OAuth sign-in when Cursor opens it.
Confirm a green status in Cursor Settings → Tools & Integrations → MCP Tools.

Manual alternative with a scoped API key — replace the placeholder on your own device:

~/.cursor/mcp.json

{
  "mcpServers": {
    "Gold Standard Analytics": {
      "url": "https://www.goldstandardanalytics.com/api/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_GSA_AGENT_TOKEN"
      }
    }
  }
}

Cursor MCP guide

VS Code (Copilot agent mode)

One-click install

Install via the link (URL-only; VS Code runs OAuth on connect) or drop the mcp.json into your workspace for key-based auth.

Install in VS Code

.vscode/mcp.json

{
  "servers": {
    "gold-standard-analytics": {
      "type": "http",
      "url": "https://www.goldstandardanalytics.com/api/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_GSA_AGENT_TOKEN"
      }
    }
  }
}

VS Code MCP guide

Codex CLI

Manual configuration

Codex reads remote Streamable HTTP MCP servers from config.toml and resolves the bearer token from an environment variable, so no secret is ever written to the file.

Create a scoped key in Account → Developer API and export it as GSA_AGENT_TOKEN in your shell profile.
Add the server under [mcp_servers.gold_standard_analytics] in ~/.codex/config.toml.
Restart Codex, then confirm the server with /mcp inside a session.

shell profile

GSA_AGENT_TOKEN=YOUR_GSA_AGENT_TOKEN

~/.codex/config.toml

[mcp_servers.gold_standard_analytics]
url = "https://www.goldstandardanalytics.com/api/mcp"
bearer_token_env_var = "GSA_AGENT_TOKEN"

Codex MCP guide

Gemini CLI

Manual configuration

httpUrl selects the streamable HTTP transport. Configure globally in ~/.gemini/settings.json or per-project in .gemini/settings.json.

~/.gemini/settings.json

{
  "mcpServers": {
    "gold-standard-analytics": {
      "httpUrl": "https://www.goldstandardanalytics.com/api/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_GSA_AGENT_TOKEN"
      },
      "timeout": 30000
    }
  }
}

Gemini CLI MCP guide

Windsurf

Manual configuration

Windsurf's Cascade agent reads remote servers (serverUrl) from mcp_config.json.

~/.codeium/windsurf/mcp_config.json

{
  "mcpServers": {
    "gold-standard-analytics": {
      "serverUrl": "https://www.goldstandardanalytics.com/api/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_GSA_AGENT_TOKEN"
      }
    }
  }
}

Windsurf MCP guide

Cline

Manual configuration

Add the server under MCP Servers → Configure (Remote Servers) or edit cline_mcp_settings.json directly.

cline_mcp_settings.json

{
  "mcpServers": {
    "gold-standard-analytics": {
      "type": "streamableHttp",
      "url": "https://www.goldstandardanalytics.com/api/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_GSA_AGENT_TOKEN"
      }
    }
  }
}

Cline MCP guide

Zed

Manual configuration

Zed configures MCP as context servers in settings.json.

settings.json

{
  "context_servers": {
    "gold-standard-analytics": {
      "source": "custom",
      "url": "https://www.goldstandardanalytics.com/api/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_GSA_AGENT_TOKEN"
      }
    }
  }
}

Zed MCP guide

Anything stdio-only (mcp-remote bridge)

Bridge configuration

For hosts without native remote MCP support, the mcp-remote bridge exposes this server as a local stdio process and handles the OAuth flow in your browser.

host MCP config

{
  "mcpServers": {
    "gold-standard-analytics": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://www.goldstandardanalytics.com/api/mcp"
      ]
    }
  }
}

mcp-remote documentation

Hermes Agent

Manual configuration

Hermes supports remote HTTP MCP servers with environment-backed request headers.

Put your key in ~/.hermes/.env.
Add the server to ~/.hermes/config.yaml.
Run hermes mcp test gold_standard_analytics, then restart Hermes or use /reload-mcp.

~/.hermes/.env

GSA_AGENT_TOKEN=YOUR_GSA_AGENT_TOKEN

~/.hermes/config.yaml

mcp_servers:
  gold_standard_analytics:
    url: "https://www.goldstandardanalytics.com/api/mcp"
    headers:
      Authorization: "Bearer ${GSA_AGENT_TOKEN}"

Hermes MCP guide

OpenClaw

Manual configuration

OpenClaw supports Streamable HTTP, static headers, and environment substitution.

Put your key in ~/.openclaw/.env.
Add the server under mcp.servers in ~/.openclaw/openclaw.json.
Verify it with openclaw mcp doctor gold-standard-analytics --probe.

~/.openclaw/.env

GSA_AGENT_TOKEN=YOUR_GSA_AGENT_TOKEN

~/.openclaw/openclaw.json

{
  "mcp": {
    "servers": {
      "gold-standard-analytics": {
        "url": "https://www.goldstandardanalytics.com/api/mcp",
        "transport": "streamable-http",
        "headers": {
          "Authorization": "Bearer ${GSA_AGENT_TOKEN}"
        }
      }
    }
  }
}

OpenClaw MCP guide

Available tools

Gold Standard Analytics MCP tools
Tool	Mode	What it does
`gsa.catalog.list`	Read	Browse current tests, bundles, prices, and requirements
`gsa.catalog.get`	Read	Read one catalog item by id
`gsa.quote.create`	Write	Create an immutable expiring quote
`gsa.quote.get`	Read	Re-read a quote's locked price, expiry, and consumption state
`gsa.order.create`	Write	Place a confirmed order from a quote
`gsa.order.reorder`	Write	Re-quote a prior order at current catalog prices
`gsa.order.list`	Read	List customer-owned laboratory orders
`gsa.order.get`	Read	Read one order and timeline; related resources are scope-filtered
`gsa.order.raw_data.get`	Read	Read released instrument-file manifests
`gsa.invoice.list`	Read	List safe invoice metadata
`gsa.invoice.get`	Read	Read one invoice without transaction details
`gsa.payment.list`	Read	List customer-owned payment state
`gsa.payment.get`	Read	Read one payment and permitted rail detail
`gsa.payment.prepare`	Write	Retry Mercury or Ethereum USDC preparation
`gsa.payment.usdc.submit`	Write	Submit a transaction hash for exact verification
`gsa.shipment.list`	Read	List labels and inbound shipments
`gsa.shipment.get`	Read	Read tracking and carrier events
`gsa.shipment.label.download`	Read	Pre-paid inbound label (PDF) with print and drop-off instructions
`gsa.order.eta`	Read	Stage-by-stage progress with a non-binding ETA
`gsa.order.custody.get`	Read	Chain-of-custody: receipt condition, vials, temps, retention deadline
`gsa.result.list`	Read	List QA-published COAs
`gsa.result.get`	Read	Read one published COA and structured results
`gsa.result.download`	Read	Signed download URL for a published COA PDF
`gsa.result.analytes.list`	Read	Normalized per-analyte rows: result, spec, method, LOD/LOQ, disposition
`gsa.coa.verify`	Read	Verify any COA's authenticity by accession number
`gsa.coa.verify_batch`	Read	Verify up to 20 COAs by accession in one call
`gsa.usage.get`	Read	Read key spend and quota usage (today + 30 days)
`gsa.account.status`	Read	Check key scopes, spend, Terms, and order-readiness
`gsa.webhook.list`	Read	List safe endpoint metadata
`gsa.webhook.create`	Write	Create a signed HTTPS endpoint
`gsa.webhook.rotate_secret`	Write	Rotate an endpoint signing secret
`gsa.webhook.delete`	Write	Delete a webhook endpoint
`gsa.webhook.test`	Write	Send a signed test delivery
`gsa.support.create`	Write	Open a support ticket answered by a human
`gsa.support.list`	Read	List this account's support tickets
`gsa.order.addons.request`	Write	Request add-on assays on the retained sample (lab confirms, then quotes)
`gsa.order.cancel.request`	Write	File a cancellation request (human-confirmed; never mutates state directly)
`gsa.notification.customer_coa.send`	Write	Consent-gated COA email to an opted-in end customer, from the GSA domain

Recommended permission sets

Catalog assistant

catalog:read

Answers test, price, matrix, bundle, and sample-requirement questions without mutations.

Order concierge

catalog:read, quotes:write, orders:read, orders:write

Add a conservative per-order and daily spending cap. Keep tool approval enabled.

Status and COA reader

orders:read, shipments:read, results:read

Tracks samples and reads published results without ordering or payment permissions.

Automation worker

Use webhooks:writeplus every subscribed event's resource-read scope; add webhooks:read or payment scopes only when the worker needs them.

Do not reuse this high-privilege key in a general chat client.

Mutation safety

A write-capable key is authorization, not intent. Order creation still requires a locked quote, confirm: true, an idempotency key, accepted customer terms, configured account addresses, scope checks, rate limits, and spend limits. Keep your client’s approval prompt enabled for quote consumption, orders, payment changes, and webhook mutations.

Verify the connection

List tools and confirm only the scopes you granted are visible.
Call gsa.catalog.list with a small limit and inspect the catalog revision.
Create a quote only after the read path works; confirm the cent total and expiry.
Before enabling ordering, set spend caps and leave mutation approval on.

Model Context Protocol

Give your agent a safe path into the lab.

The GSA MCP server exposes the same tenant-isolated commerce and result services as REST, with scope-filtered discovery, mutation guards, spend controls, and published-only result reads.

Choose your client Create a scoped key

Connection

https://www.goldstandardanalytics.com/api/mcp

Client setup

Connect any agent in under a minute

Claude (claude.ai, Desktop, Code, API)

OAuth one-click + API key

Hosted Claude connects with just the URL via OAuth. Claude Code takes one command. The Claude API attaches the server per-request with the MCP connector.

claude.ai / Claude Desktop

Settings → Connectors → Add custom connector.
Paste https://www.goldstandardanalytics.com/api/mcp and click Add. The OAuth sign-in and consent screen run automatically — no key to paste.
Enable the connector's tools from the chat composer's tools menu.

Hosted Claude connector guide

Claude Code

One command. Keep the header for key-based auth, or drop it to use the OAuth flow (/mcp then authenticate).

Terminal

claude mcp add --transport http gold-standard-analytics \
  "https://www.goldstandardanalytics.com/api/mcp" \
  --header "Authorization: Bearer YOUR_GSA_AGENT_TOKEN"

Claude Code MCP guide

Claude API (MCP connector)

Add this block to a Messages request (beta header anthropic-beta: mcp-client-2025-04-04).

Messages API request body

{
  "mcp_servers": [
    {
      "type": "url",
      "url": "https://www.goldstandardanalytics.com/api/mcp",
      "name": "gold-standard-analytics",
      "authorization_token": "YOUR_GSA_AGENT_TOKEN"
    }
  ]
}

ChatGPT + OpenAI API

OAuth one-click + API key

ChatGPT custom connectors onboard via OAuth with just the URL. The Responses API / Agents SDK attaches the server per-request with a scoped key.

ChatGPT connectors

Settings → Connectors → Advanced → Add custom connector (developer mode where required).
Name it and paste https://www.goldstandardanalytics.com/api/mcp. ChatGPT discovers the OAuth server and walks through sign-in and consent.
Pick the connector from Tools in the composer.

ChatGPT connection flow

Responses API / Agents SDK

Responses API request body

{
  "tools": [
    {
      "type": "mcp",
      "server_label": "gold_standard_analytics",
      "server_url": "https://www.goldstandardanalytics.com/api/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_GSA_AGENT_TOKEN"
      },
      "require_approval": "always"
    }
  ]
}

Cursor

One-click install

The install link carries only the endpoint URL; Cursor then runs the OAuth flow. Prefer a static key instead? Use the manual mcp.json below.

Add to Cursor (app)Add to Cursor (web)

Click an install link and approve the server in Cursor's dialog.
Complete the OAuth sign-in when Cursor opens it.
Confirm a green status in Cursor Settings → Tools & Integrations → MCP Tools.

Manual alternative with a scoped API key — replace the placeholder on your own device:

~/.cursor/mcp.json

{
  "mcpServers": {
    "Gold Standard Analytics": {
      "url": "https://www.goldstandardanalytics.com/api/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_GSA_AGENT_TOKEN"
      }
    }
  }
}

Cursor MCP guide

VS Code (Copilot agent mode)

One-click install

Install via the link (URL-only; VS Code runs OAuth on connect) or drop the mcp.json into your workspace for key-based auth.

Install in VS Code

.vscode/mcp.json

{
  "servers": {
    "gold-standard-analytics": {
      "type": "http",
      "url": "https://www.goldstandardanalytics.com/api/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_GSA_AGENT_TOKEN"
      }
    }
  }
}

VS Code MCP guide

Codex CLI

Manual configuration

Codex reads remote Streamable HTTP MCP servers from config.toml and resolves the bearer token from an environment variable, so no secret is ever written to the file.

Create a scoped key in Account → Developer API and export it as GSA_AGENT_TOKEN in your shell profile.
Add the server under [mcp_servers.gold_standard_analytics] in ~/.codex/config.toml.
Restart Codex, then confirm the server with /mcp inside a session.

shell profile

GSA_AGENT_TOKEN=YOUR_GSA_AGENT_TOKEN

~/.codex/config.toml

[mcp_servers.gold_standard_analytics]
url = "https://www.goldstandardanalytics.com/api/mcp"
bearer_token_env_var = "GSA_AGENT_TOKEN"

Codex MCP guide

Gemini CLI

Manual configuration

httpUrl selects the streamable HTTP transport. Configure globally in ~/.gemini/settings.json or per-project in .gemini/settings.json.

~/.gemini/settings.json

{
  "mcpServers": {
    "gold-standard-analytics": {
      "httpUrl": "https://www.goldstandardanalytics.com/api/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_GSA_AGENT_TOKEN"
      },
      "timeout": 30000
    }
  }
}

Gemini CLI MCP guide

Windsurf

Manual configuration

Windsurf's Cascade agent reads remote servers (serverUrl) from mcp_config.json.

~/.codeium/windsurf/mcp_config.json

{
  "mcpServers": {
    "gold-standard-analytics": {
      "serverUrl": "https://www.goldstandardanalytics.com/api/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_GSA_AGENT_TOKEN"
      }
    }
  }
}

Windsurf MCP guide

Cline

Manual configuration

Add the server under MCP Servers → Configure (Remote Servers) or edit cline_mcp_settings.json directly.

cline_mcp_settings.json

{
  "mcpServers": {
    "gold-standard-analytics": {
      "type": "streamableHttp",
      "url": "https://www.goldstandardanalytics.com/api/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_GSA_AGENT_TOKEN"
      }
    }
  }
}

Cline MCP guide

Zed

Manual configuration

Zed configures MCP as context servers in settings.json.

settings.json

{
  "context_servers": {
    "gold-standard-analytics": {
      "source": "custom",
      "url": "https://www.goldstandardanalytics.com/api/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_GSA_AGENT_TOKEN"
      }
    }
  }
}

Zed MCP guide

Anything stdio-only (mcp-remote bridge)

Bridge configuration

For hosts without native remote MCP support, the mcp-remote bridge exposes this server as a local stdio process and handles the OAuth flow in your browser.

host MCP config

{
  "mcpServers": {
    "gold-standard-analytics": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://www.goldstandardanalytics.com/api/mcp"
      ]
    }
  }
}

mcp-remote documentation

Hermes Agent

Manual configuration

Hermes supports remote HTTP MCP servers with environment-backed request headers.

Put your key in ~/.hermes/.env.
Add the server to ~/.hermes/config.yaml.
Run hermes mcp test gold_standard_analytics, then restart Hermes or use /reload-mcp.

~/.hermes/.env

GSA_AGENT_TOKEN=YOUR_GSA_AGENT_TOKEN

~/.hermes/config.yaml

mcp_servers:
  gold_standard_analytics:
    url: "https://www.goldstandardanalytics.com/api/mcp"
    headers:
      Authorization: "Bearer ${GSA_AGENT_TOKEN}"

Hermes MCP guide

OpenClaw

Manual configuration

OpenClaw supports Streamable HTTP, static headers, and environment substitution.

Put your key in ~/.openclaw/.env.
Add the server under mcp.servers in ~/.openclaw/openclaw.json.
Verify it with openclaw mcp doctor gold-standard-analytics --probe.

~/.openclaw/.env

GSA_AGENT_TOKEN=YOUR_GSA_AGENT_TOKEN

~/.openclaw/openclaw.json

{
  "mcp": {
    "servers": {
      "gold-standard-analytics": {
        "url": "https://www.goldstandardanalytics.com/api/mcp",
        "transport": "streamable-http",
        "headers": {
          "Authorization": "Bearer ${GSA_AGENT_TOKEN}"
        }
      }
    }
  }
}

OpenClaw MCP guide

Available tools

Gold Standard Analytics MCP tools
Tool	Mode	What it does
`gsa.catalog.list`	Read	Browse current tests, bundles, prices, and requirements
`gsa.catalog.get`	Read	Read one catalog item by id
`gsa.quote.create`	Write	Create an immutable expiring quote
`gsa.quote.get`	Read	Re-read a quote's locked price, expiry, and consumption state
`gsa.order.create`	Write	Place a confirmed order from a quote
`gsa.order.reorder`	Write	Re-quote a prior order at current catalog prices
`gsa.order.list`	Read	List customer-owned laboratory orders
`gsa.order.get`	Read	Read one order and timeline; related resources are scope-filtered
`gsa.order.raw_data.get`	Read	Read released instrument-file manifests
`gsa.invoice.list`	Read	List safe invoice metadata
`gsa.invoice.get`	Read	Read one invoice without transaction details
`gsa.payment.list`	Read	List customer-owned payment state
`gsa.payment.get`	Read	Read one payment and permitted rail detail
`gsa.payment.prepare`	Write	Retry Mercury or Ethereum USDC preparation
`gsa.payment.usdc.submit`	Write	Submit a transaction hash for exact verification
`gsa.shipment.list`	Read	List labels and inbound shipments
`gsa.shipment.get`	Read	Read tracking and carrier events
`gsa.shipment.label.download`	Read	Pre-paid inbound label (PDF) with print and drop-off instructions
`gsa.order.eta`	Read	Stage-by-stage progress with a non-binding ETA
`gsa.order.custody.get`	Read	Chain-of-custody: receipt condition, vials, temps, retention deadline
`gsa.result.list`	Read	List QA-published COAs
`gsa.result.get`	Read	Read one published COA and structured results
`gsa.result.download`	Read	Signed download URL for a published COA PDF
`gsa.result.analytes.list`	Read	Normalized per-analyte rows: result, spec, method, LOD/LOQ, disposition
`gsa.coa.verify`	Read	Verify any COA's authenticity by accession number
`gsa.coa.verify_batch`	Read	Verify up to 20 COAs by accession in one call
`gsa.usage.get`	Read	Read key spend and quota usage (today + 30 days)
`gsa.account.status`	Read	Check key scopes, spend, Terms, and order-readiness
`gsa.webhook.list`	Read	List safe endpoint metadata
`gsa.webhook.create`	Write	Create a signed HTTPS endpoint
`gsa.webhook.rotate_secret`	Write	Rotate an endpoint signing secret
`gsa.webhook.delete`	Write	Delete a webhook endpoint
`gsa.webhook.test`	Write	Send a signed test delivery
`gsa.support.create`	Write	Open a support ticket answered by a human
`gsa.support.list`	Read	List this account's support tickets
`gsa.order.addons.request`	Write	Request add-on assays on the retained sample (lab confirms, then quotes)
`gsa.order.cancel.request`	Write	File a cancellation request (human-confirmed; never mutates state directly)
`gsa.notification.customer_coa.send`	Write	Consent-gated COA email to an opted-in end customer, from the GSA domain

Recommended permission sets

Catalog assistant

catalog:read

Answers test, price, matrix, bundle, and sample-requirement questions without mutations.

Order concierge

catalog:read, quotes:write, orders:read, orders:write

Add a conservative per-order and daily spending cap. Keep tool approval enabled.

Status and COA reader

orders:read, shipments:read, results:read

Tracks samples and reads published results without ordering or payment permissions.

Automation worker

Use webhooks:writeplus every subscribed event's resource-read scope; add webhooks:read or payment scopes only when the worker needs them.

Do not reuse this high-privilege key in a general chat client.

Mutation safety

Verify the connection

List tools and confirm only the scopes you granted are visible.
Call gsa.catalog.list with a small limit and inspect the catalog revision.
Create a quote only after the read path works; confirm the cent total and expiry.
Before enabling ordering, set spend caps and leave mutation approval on.