Reference
The same commercial authority as the REST API, reached over Model Context Protocol. One contract, two dialects.
endpoint https://mcp.swisstouristy.com/
authorization https://mcp.swisstouristy.com/.well-known/oauth-protected-resource
token endpoint https://swisstouristy.eu.auth0.com/oauth/tokenAn unauthenticated request returns 401 with a WWW-Authenticate header naming the resource-metadata URL, per RFC 9728. A conforming client discovers the authorization server from there without being told.
Dynamic client registration is disabled
Clients that register themselves — MCP Inspector and Claude Desktop among them — will complete discovery correctly and then fail at the authorize step. That is a tenant setting, not a fault in your client. Credentials are issued by hand: request access.
Every MCP connection needs discovery at the transport level, whatever it goes on to call. The other three gate individual tools exactly as they gate the matching REST operations.
checkout:prepareHand a traveler to Swiss Touristy's hosted checkout for a live quote of your own. Creates no booking and takes no payment.discoveryConnect to the MCP server. Required by the MCP transport on every connection; no REST operation requires it, and the REST discovery endpoints are anonymous.quote:createCreate a quote of your own.quote:read-ownRead a quote you created. Never another caller's.| Tool | What it does |
|---|---|
| list_transfer_services | The transfer corridors Swiss Touristy serves. |
| get_route | Distance and baseline duration for one journey. |
| list_vehicle_classes | Fleet classes with passenger and luggage capacity. |
| get_policy | A published policy — cancellation, waiting, luggage. |
| get_quote_requirements | The fields a quote needs before you ask for one. |
| request_quote_intent | A non-binding estimate. Persists nothing. |
| create_transfer_quote | An authoritative 30-minute price snapshot. |
| get_own_quote | Read back a quote you created. Never another caller's. |
| prepare_checkout_handoff | A hosted-checkout URL for a live quote of your own. |
That list is frozen by an allowlist test in the server's own suite, so a tool cannot appear on the public surface without a reviewed change. No booking, payment, refund, cancellation or amendment tool exists, and none is planned for v1.
A tool failure carries the same error codes as the REST surface, rendered as a typed tool result rather than problem+json. The code a REST caller sees and the code an MCP caller sees are produced by the same raise, so you can write one error-handling path for both.
Shared with REST, not additional to it — see rate limits.