Card-skimmer data, answerable by any AI.

1 · Add it by URL (Claude.ai, ChatGPT and other hosted assistants)

Hosted assistants add a remote MCP server from a settings screen — there is no file to edit. Open your assistant's Connectors / MCP servers settings, choose to add a custom or remote server, and paste the URL below. The public tier needs no credential, so it connects immediately.

https://mcp.skimguard.io/mcp

Give it any name you like (“SkimGuard”) and leave authentication set to none — the public tools connect straight away. When you later ask for data from your own account, the server prompts you to sign in. If the screen offers a transport choice, pick HTTP / Streamable HTTP — not SSE, and not stdio.

2 · Or add it to a config file (Claude Desktop, Claude Code, Cursor)

Desktop and editor clients read an mcpServers block from a JSON file. Drop the config below into yours and restart the client — the SkimGuard tools appear in the tool list.

{
  "mcpServers": {
    "skimguard": {
      "url": "https://mcp.skimguard.io/mcp"
    }
  }
}

Holding a paid key? Add it as a header. The server also accepts a Firebase ID token as Authorization: Bearer <token> if you are calling from an authenticated SkimGuard portal session.

{
  "mcpServers": {
    "skimguard": {
      "url": "https://mcp.skimguard.io/mcp",
      "headers": { "X-MCP-Key": "YOUR_KEY_HERE" }
    }
  }
}

3 · Or just curl it

The endpoint speaks JSON-RPC 2.0 over the MCP Streamable HTTP transport. It is stateless, so you do not need an initialize handshake first. The Accept header is required and must list both application/json and text/event-stream — the transport returns 406 without it.

curl -s https://mcp.skimguard.io/mcp \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

Start here — this is the one you can run with nothing but a place name. skimguard_search_locations resolves the name first, then reports SkimGuard's scan status for each match, so a single call goes from "the Shell on Riverside" to an answer. Passing latitude/longitude is optional but sharply improves matching on common brand names.

curl -s https://mcp.skimguard.io/mcp \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{
        "name":"skimguard_search_locations",
        "arguments":{"query":"Shell gas station Riverside Austin TX",
                     "latitude":30.2453,"longitude":-97.7431,
                     "limit":5,"days":30,"response_format":"markdown"}}}'

curl -s https://mcp.skimguard.io/mcp \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{
        "name":"skimguard_coverage_stats",
        "arguments":{"days":30,"response_format":"markdown"}}}'

curl -s https://mcp.skimguard.io/mcp \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":4,"method":"tools/call","params":{
        "name":"skimguard_get_location_status",
        "arguments":{"placeId":"ChIJN1t_tDeuEmsRUsoyG83frY4",
                     "days":30,"response_format":"json"}}}'

Swap in the Google Place ID of a location you care about. If SkimGuard has no data for it yet you get a plain "no data" answer — that means unknown, not unsafe. Private residences are deliberately excluded from public data and always answer that way.

curl -s https://mcp.skimguard.io/health

Scoped tools filter on the identifier resolved from your credential, never from tool input — for all but one there is no parameter through which another account's data could be requested. The exception is skimguard_location_devices, which takes a Place ID and therefore checks ownership before it queries anything.
Business and Partner are peers: a merchant never sees a reseller's tools and vice versa. Data Licensee outranks both — a licensee key that also carries a business or reseller id gets those scoped tools too, still filtered to its own ids.