Tefter MCP

Remote MCP server for order investigation.

Endpoint

URLhttps://mcp.tefter.com/mcp
TransportMCP Streamable HTTP, stateless, JSON responses. POST only.
AuthAuthorization: Bearer tftk_… — exactly one header, managed key with audience mcp.
ReachableOnly / and /mcp are routed from the internet.

1. Get a key

  1. Sign in to the TX webapp as a MASTERADMIN of your organization.
  2. Open Administracija organizacijeKredencijali.
  3. Create a service account with scope orders:read.
  4. Create a token under it with audience mcp and scope orders:read.
  5. Copy the key. It is shown once. Store it in an environment variable, for example TEFTER_MCP_KEY.

A key reads one organization only: the one that minted it. Revoke the key in Kredencijali to cut access.

2. Connect a client

opencodeopencode.json (project) or ~/.config/opencode/opencode.json:

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "tefter": {
      "type": "remote",
      "url": "https://mcp.tefter.com/mcp",
      "enabled": true,
      "oauth": false,
      "headers": { "Authorization": "Bearer {env:TEFTER_MCP_KEY}" }
    }
  }
}

Claude Code:

claude mcp add --transport http tefter https://mcp.tefter.com/mcp \
  --header "Authorization: Bearer ${TEFTER_MCP_KEY}"

3. Test it

List the tools your key can see:

curl -s https://mcp.tefter.com/mcp \
  -H "Authorization: Bearer ${TEFTER_MCP_KEY}" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

Read one order (canonical order ID or the supplier's inbound document ID):

curl -s https://mcp.tefter.com/mcp \
  -H "Authorization: Bearer ${TEFTER_MCP_KEY}" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"tefter_get_order_detail","arguments":{"order_id":"<order-id>"}}}'

Tools

ToolScopeWhat it returns
tefter_get_order_detailorders:readOne TX order from your organization's viewpoint: status, pause reason, parties, paginated article lines.

If something fails

ResponseMeaning
401Key malformed, expired, revoked, wrong audience, or minted for another environment. The body is the same for all of these on purpose.
403Browser Origin not trusted. CLI clients send no Origin.
400 header mismatchMcp-Method / Mcp-Name headers disagree with the JSON-RPC body. Remove or fix them.
503The server could not reach a dependency. Retry shortly.
Empty tool listThe key lacks the orders:read scope.