Model Context Protocol

Give your agent a safe path into the lab.

The GSA MCP server exposes the same tenant-isolated commerce and result services as REST, with scope-filtered discovery, mutation guards, spend controls, and published-only result reads.

Choose your client Create a scoped key

Connection

https://www.goldstandardanalytics.com/api/mcp

Transport is stateless Streamable HTTP (JSON responses) over HTTPS. Authenticate every request with a customer-bound gsa_live_… bearer key. The server implements initialize, ping, tool discovery, and tool calls. Discovery filters tools by their static required scopes; event-specific read scopes for webhook creation are enforced when that tool is called.

Current authentication: GSA uses static, revocable agent keys. Never put a real key in an install URL. Cursor can install the endpoint in one click, but the key is added locally afterward. Hosted Claude and ChatGPT cannot use the current static-key endpoint; both require GSA to add OAuth before an authenticated connection can work.

Client setup

Connect your MCP client

Gold Standard Analytics currently authenticates MCP requests with a customer-scoped API key. Choose your client below, create a key in the developer portal, and replace only the clearly marked placeholder on your own device.

Hermes Agent

Manual configuration

Hermes supports remote HTTP MCP servers with environment-backed request headers. There is no supported public install deep link for arbitrary servers.

Put your key in ~/.hermes/.env.
Add the server to ~/.hermes/config.yaml.
Run hermes mcp test gold_standard_analytics, then restart Hermes or use /reload-mcp.

~/.hermes/.env

GSA_AGENT_TOKEN=YOUR_GSA_AGENT_TOKEN

~/.hermes/config.yaml

mcp_servers:
  gold_standard_analytics:
    url: "https://www.goldstandardanalytics.com/api/mcp"
    headers:
      Authorization: "Bearer ${GSA_AGENT_TOKEN}"

Read the Hermes MCP guide

OpenClaw

Manual configuration

OpenClaw supports Streamable HTTP, static headers, and environment substitution. Arbitrary external websites cannot trigger a supported one-click install.

Put your key in ~/.openclaw/.env.
Add the server under mcp.servers in ~/.openclaw/openclaw.json.
Verify it with openclaw mcp doctor gold-standard-analytics --probe.

~/.openclaw/.env

GSA_AGENT_TOKEN=YOUR_GSA_AGENT_TOKEN

~/.openclaw/openclaw.json

{
  "mcp": {
    "servers": {
      "gold-standard-analytics": {
        "url": "https://www.goldstandardanalytics.com/api/mcp",
        "transport": "streamable-http",
        "headers": {
          "Authorization": "Bearer ${GSA_AGENT_TOKEN}"
        }
      }
    }
  }
}

Read the OpenClaw MCP guide

Cursor

Endpoint installer available

Cursor can install the public MCP endpoint from a supported deep link. The link contains no secret, so you must add your API-key header locally afterward.

Two steps are required: add the endpoint, then add the API key. The button does not authenticate the connection.

Open the endpoint installer and approve the server in Cursor.
Edit ~/.cursor/mcp.json and add the Authorization header shown below, replacing the placeholder locally.
Confirm a green status in Cursor Settings → Tools & Integrations → MCP Tools.

Add endpoint to CursorThen add your API key in Cursor.

~/.cursor/mcp.json

{
  "mcpServers": {
    "gold-standard-analytics": {
      "url": "https://www.goldstandardanalytics.com/api/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_GSA_AGENT_TOKEN"
      }
    }
  }
}

Read the Cursor MCP guide

Claude

Claude Code ready; hosted OAuth required

Claude Code accepts the current API-key connection. Hosted Claude does not support a user-pasted static bearer token, so GSA must add OAuth before that connector can authenticate.

Claude Code

Run the command locally after replacing the placeholder. It adds the remote HTTP MCP server and Authorization header.

Terminal

claude mcp add --transport http gold-standard-analytics \
  "https://www.goldstandardanalytics.com/api/mcp" \
  --header "Authorization: Bearer YOUR_GSA_AGENT_TOKEN"

Read the Claude Code MCP guide

Hosted Claude

The current GSA static-key endpoint cannot authenticate a hosted Claude connector. Do not paste a GSA API key into Claude. GSA must first add OAuth; eligible account owners can then enable the custom connector through their organization settings.

Open hosted Claude setup instructions

ChatGPT

OAuth required

ChatGPT does not accept a custom API key for authenticated MCP apps. The current GSA endpoint therefore cannot be connected to ChatGPT yet.

Do not paste a GSA API key into ChatGPT. A working integration requires GSA to add OAuth 2.1 authorization first. Opening developer-mode app setup today will not remove that requirement.

After OAuth launches, eligible ChatGPT workspaces will be able to register the public MCP URL through ChatGPT's plugin setup. Public one-click availability would still require OpenAI review and directory publication.

Review ChatGPT authentication requirements Review the ChatGPT connection flow

Available tools

Gold Standard Analytics MCP tools
Tool	Mode	What it does
`gsa.catalog.list`	Read	Browse current tests, bundles, prices, and requirements
`gsa.quote.create`	Write	Create an immutable expiring quote
`gsa.order.create`	Write	Place a confirmed order from a quote
`gsa.order.list`	Read	List customer-owned laboratory orders
`gsa.order.get`	Read	Read one order and timeline; related resources are scope-filtered
`gsa.order.raw_data.get`	Read	Read released instrument-file manifests
`gsa.invoice.list`	Read	List safe invoice metadata
`gsa.invoice.get`	Read	Read one invoice without transaction details
`gsa.payment.list`	Read	List customer-owned payment state
`gsa.payment.get`	Read	Read one payment and permitted rail detail
`gsa.payment.prepare`	Write	Retry Mercury or Ethereum USDC preparation
`gsa.payment.usdc.submit`	Write	Submit a transaction hash for exact verification
`gsa.shipment.list`	Read	List labels and inbound shipments
`gsa.shipment.get`	Read	Read tracking and carrier events
`gsa.result.list`	Read	List QA-published COAs
`gsa.result.get`	Read	Read one published COA and structured results
`gsa.webhook.list`	Read	List safe endpoint metadata
`gsa.webhook.create`	Write	Create a signed HTTPS endpoint
`gsa.webhook.rotate_secret`	Write	Rotate an endpoint signing secret
`gsa.webhook.delete`	Write	Delete a webhook endpoint
`gsa.webhook.test`	Write	Send a signed test delivery

Recommended permission sets

Catalog assistant

catalog:read

Answers test, price, matrix, bundle, and sample-requirement questions without mutations.

Order concierge

catalog:read, quotes:write, orders:read, orders:write

Add a conservative per-order and daily spending cap. Keep tool approval enabled.

Status and COA reader

orders:read, shipments:read, results:read

Tracks samples and reads published results without ordering or payment permissions.

Automation worker

Use webhooks:writeplus every subscribed event's resource-read scope; add webhooks:read or payment scopes only when the worker needs them.

Do not reuse this high-privilege key in a general chat client.

Mutation safety

A write-capable key is authorization, not intent. Order creation still requires a locked quote, confirm: true, an idempotency key, accepted customer terms, configured account addresses, scope checks, rate limits, and spend limits. Keep your client’s approval prompt enabled for quote consumption, orders, payment changes, and webhook mutations.

Verify the connection

List tools and confirm only the scopes you granted are visible.
Call gsa.catalog.list with a small limit and inspect the catalog revision.
Create a quote only after the read path works; confirm the cent total and expiry.
Before enabling ordering, set spend caps and leave mutation approval on.

Connection

https://www.goldstandardanalytics.com/api/mcp

Client setup

Connect your MCP client

Hermes Agent

Manual configuration

Hermes supports remote HTTP MCP servers with environment-backed request headers. There is no supported public install deep link for arbitrary servers.

Put your key in ~/.hermes/.env.
Add the server to ~/.hermes/config.yaml.
Run hermes mcp test gold_standard_analytics, then restart Hermes or use /reload-mcp.

~/.hermes/.env

GSA_AGENT_TOKEN=YOUR_GSA_AGENT_TOKEN

~/.hermes/config.yaml

mcp_servers:
  gold_standard_analytics:
    url: "https://www.goldstandardanalytics.com/api/mcp"
    headers:
      Authorization: "Bearer ${GSA_AGENT_TOKEN}"

Read the Hermes MCP guide

OpenClaw

Manual configuration

OpenClaw supports Streamable HTTP, static headers, and environment substitution. Arbitrary external websites cannot trigger a supported one-click install.

Put your key in ~/.openclaw/.env.
Add the server under mcp.servers in ~/.openclaw/openclaw.json.
Verify it with openclaw mcp doctor gold-standard-analytics --probe.

~/.openclaw/.env

GSA_AGENT_TOKEN=YOUR_GSA_AGENT_TOKEN

~/.openclaw/openclaw.json

{
  "mcp": {
    "servers": {
      "gold-standard-analytics": {
        "url": "https://www.goldstandardanalytics.com/api/mcp",
        "transport": "streamable-http",
        "headers": {
          "Authorization": "Bearer ${GSA_AGENT_TOKEN}"
        }
      }
    }
  }
}

Read the OpenClaw MCP guide

Cursor

Endpoint installer available

Cursor can install the public MCP endpoint from a supported deep link. The link contains no secret, so you must add your API-key header locally afterward.

Two steps are required: add the endpoint, then add the API key. The button does not authenticate the connection.

Open the endpoint installer and approve the server in Cursor.
Edit ~/.cursor/mcp.json and add the Authorization header shown below, replacing the placeholder locally.
Confirm a green status in Cursor Settings → Tools & Integrations → MCP Tools.

Add endpoint to CursorThen add your API key in Cursor.

~/.cursor/mcp.json

{
  "mcpServers": {
    "gold-standard-analytics": {
      "url": "https://www.goldstandardanalytics.com/api/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_GSA_AGENT_TOKEN"
      }
    }
  }
}

Read the Cursor MCP guide

Claude

Claude Code ready; hosted OAuth required

Claude Code accepts the current API-key connection. Hosted Claude does not support a user-pasted static bearer token, so GSA must add OAuth before that connector can authenticate.

Claude Code

Run the command locally after replacing the placeholder. It adds the remote HTTP MCP server and Authorization header.

Terminal

claude mcp add --transport http gold-standard-analytics \
  "https://www.goldstandardanalytics.com/api/mcp" \
  --header "Authorization: Bearer YOUR_GSA_AGENT_TOKEN"

Read the Claude Code MCP guide

Hosted Claude

Open hosted Claude setup instructions

ChatGPT

OAuth required

ChatGPT does not accept a custom API key for authenticated MCP apps. The current GSA endpoint therefore cannot be connected to ChatGPT yet.

Do not paste a GSA API key into ChatGPT. A working integration requires GSA to add OAuth 2.1 authorization first. Opening developer-mode app setup today will not remove that requirement.

Review ChatGPT authentication requirements Review the ChatGPT connection flow

Available tools

Gold Standard Analytics MCP tools
Tool	Mode	What it does
`gsa.catalog.list`	Read	Browse current tests, bundles, prices, and requirements
`gsa.quote.create`	Write	Create an immutable expiring quote
`gsa.order.create`	Write	Place a confirmed order from a quote
`gsa.order.list`	Read	List customer-owned laboratory orders
`gsa.order.get`	Read	Read one order and timeline; related resources are scope-filtered
`gsa.order.raw_data.get`	Read	Read released instrument-file manifests
`gsa.invoice.list`	Read	List safe invoice metadata
`gsa.invoice.get`	Read	Read one invoice without transaction details
`gsa.payment.list`	Read	List customer-owned payment state
`gsa.payment.get`	Read	Read one payment and permitted rail detail
`gsa.payment.prepare`	Write	Retry Mercury or Ethereum USDC preparation
`gsa.payment.usdc.submit`	Write	Submit a transaction hash for exact verification
`gsa.shipment.list`	Read	List labels and inbound shipments
`gsa.shipment.get`	Read	Read tracking and carrier events
`gsa.result.list`	Read	List QA-published COAs
`gsa.result.get`	Read	Read one published COA and structured results
`gsa.webhook.list`	Read	List safe endpoint metadata
`gsa.webhook.create`	Write	Create a signed HTTPS endpoint
`gsa.webhook.rotate_secret`	Write	Rotate an endpoint signing secret
`gsa.webhook.delete`	Write	Delete a webhook endpoint
`gsa.webhook.test`	Write	Send a signed test delivery

Recommended permission sets

Catalog assistant

catalog:read

Answers test, price, matrix, bundle, and sample-requirement questions without mutations.

Order concierge

catalog:read, quotes:write, orders:read, orders:write

Add a conservative per-order and daily spending cap. Keep tool approval enabled.

Status and COA reader

orders:read, shipments:read, results:read

Tracks samples and reads published results without ordering or payment permissions.

Automation worker

Use webhooks:writeplus every subscribed event's resource-read scope; add webhooks:read or payment scopes only when the worker needs them.

Do not reuse this high-privilege key in a general chat client.

Mutation safety