Skip to main content
The Kibo Commerce MCP Server enables AI agents to securely access your live commerce data through the Model Context Protocol (MCP). MCP is an open standard that allows AI applications to connect to external data sources and tools through a unified interface. With the Kibo MCP Server, AI assistants like Claude Desktop, Cursor, Windsurf, or VS Code with GitHub Copilot can query your product catalog, manage orders, look up customer information, configure shipping, adjust site settings, and much more — directly from your Kibo Commerce tenant. All requests are authenticated through your existing Kibo API credentials, and data access follows your tenant’s permission model.
Looking for documentation access? This page covers the Commerce MCP Server for accessing your catalog, orders, and inventory data. If you want AI tools to access Kibo documentation, see Using Kibo Documentation with AI for the Documentation MCP Server.

Prerequisites

Before configuring the MCP Server, ensure you have:
  • Kibo Commerce tenant with API access
  • Application credentials (Application Key and Client Secret) from Kibo Dev Center
  • Claude Desktop, Cursor, or another MCP-compatible client
  • Node.js 18+ (only required if using the MCP Inspector for debugging)

Getting Your Credentials

  1. Log into your Kibo Commerce Admin Console
  2. Navigate to System > Applications
  3. Create a new application or use an existing one
  4. Note the following values:
    • Application Key (also called Client ID)
    • Client Secret
    • Tenant ID
    • Site ID (if needed for site-scoped operations)
    • API Host URL (e.g., https://t1000000.sb.usc1.gcp.kibocommerce.com)

MCP Server URL

The Kibo MCP Server is a hosted HTTP endpoint available on your Kibo Commerce tenant. The endpoint URL follows this pattern:

With Tenant + Site ID

Include both the tenant and site identifiers when you need site-scoped operations:

With Tenant Only

Omit the site identifier for tenant-level operations:
Some API operations require a site context. If a tool call fails with a missing site error, switch to the tenant + site URL format.

Authorization Methods

Every request to the MCP endpoint must include an Authorization header. The server supports two methods.

Method 1: Basic Authentication (Base64-Encoded Credentials)

Use your Application Key and Client Secret, separated by a colon and Base64-encoded, in a standard HTTP Basic auth header. Steps:
  1. Obtain your Application Key and Client Secret from the Kibo Dev Center.
  2. Concatenate them with a colon separator:
  3. Base64-encode the result.
  4. Send the encoded value in the Authorization header with the Basic scheme.
Example:

Method 2: JWT Bearer Token (Kibo API Auth)

This is the standard Kibo API authentication flow. You exchange your Application Key and Client Secret for a short-lived JWT access token using the Kibo OAuth endpoint, then pass that token as a Bearer credential. Steps:
  1. Request an access token from the Kibo authentication endpoint:
    With the request body:
  2. Extract the access_token from the response.
  3. Send the token in the Authorization header with the Bearer scheme.
Example:
Bearer tokens expire (typically in 1 hour). Your MCP client should handle token refresh automatically or re-authenticate when a 401 response is received.

Client Configuration

Configure your MCP client to connect to the Kibo MCP Server hosted endpoint.

Claude Desktop

Configuration File Location

Basic Configuration

Add the following to your claude_desktop_config.json, replacing the URL and authorization value with your own:

Multiple Environments

To connect to both sandbox and production environments:

Cursor

Add the MCP server to your .cursor/mcp.json file:

Windsurf

Add the following to your ~/.codeium/windsurf/mcp_config.json file:

VS Code with GitHub Copilot

Add the following to your VS Code settings.json:

Filtering Tools by Category

By default, connecting to /mcp/admin/ exposes all registered tools (500+ operations). You can limit the tools returned to your MCP client by appending a comma-separated list of category names to the URL path.

Single Category

Returns only the tools in the categories.read category.

Multiple Categories

Returns tools from both categories.read and categories.update.

All Tools (Default)

Returns every tool across all categories.
Request only the categories you need. Fewer tools means faster discovery for your AI assistant and lower token usage when the tool list is sent as context.

Testing the Connection

After configuration, restart your AI client and test with a query:
To verify the tools are loaded:

Using the MCP Inspector

The MCP Inspector is a visual debugging tool for interacting with MCP servers. It lets you discover tools, execute them, and inspect the request/response cycle.

Quick Start

  1. Launch the inspector against your Kibo MCP Server:
  2. The inspector UI will open in your browser. From there you can:
    • List Tools — view all tools exposed by the server
    • Call a Tool — fill in parameters and execute a tool call
    • View Responses — inspect the raw JSON returned by each tool

Configuring the URL

Enter your Kibo MCP Server URL in the inspector’s URL field:
MCP Inspector URL configuration

Adding Authorization

Provide the Authorization header in the inspector’s Headers configuration section before initializing the session. Enter the header exactly as you would in an HTTP request:
or
MCP Inspector authorization configuration

Listing Tools

Once connected, use the List Tools button to see all available tools for the configured categories:
MCP Inspector tool list

Available Tool Categories

Categories follow the naming convention {resource}.{operation}, where operation is one of create, read, update, or delete.

Commerce Runtime

Customer

Import / Export

Location

Pricing Runtime

Product Admin

Shipping Admin

Shipping Runtime

Site Settings

Subscription

Troubleshooting

Authentication Errors

401 Unauthorized
  • Verify your Application Key and Client Secret are correct
  • If using Basic auth, check that the Base64 encoding is correct
  • If using Bearer tokens, the token may have expired — request a new one
  • Check that the application has required API permissions in Kibo Admin
  • Confirm Tenant ID and Site ID match your environment
403 Forbidden
  • Verify your application has access to the requested resources
  • Check that your Site ID is correct for the operation

Network Errors

Connection Timeout
  • Check your internet connection
  • Verify the API Host URL is accessible
  • Check firewall or proxy settings

Missing Data

Empty Results
  • Verify data exists in your Kibo Commerce tenant
  • Check that you are querying the correct site and catalog
  • Try different search parameters
  • If the error mentions a missing site context, switch to the tenant + site URL format

Resources