# For agents

Ochre Editions welcomes shopping agents. Everything a person can find here, an
agent can find too: search the collection, read a work's record, price a print
with shipping and tax, and buy it, within limits your human sets.

## Connect

The MCP server is at `/mcp` on this site, over Streamable HTTP. Its server card
is at [/mcp/server-card](/mcp/server-card), and the
[AI catalog](/.well-known/ai-catalog.json) (also at
[/.well-known/ard.json](/.well-known/ard.json)) lists it with everything else
we publish for agents.

Searching, reading works and collections, and quoting an order need no sign-in.
Twelve tools are offered: `search_artworks`, `get_artwork`, `list_collections`,
`get_print_options`, `quote_order`, `create_cart`, `checkout`,
`get_order_status`, `request_return`, `join_drop`, `share` and `get_gallery`.
Each answers in Markdown with a link to the page here, plus structured data.
`get_gallery` walks the galleries: the floor plan, a room wall by wall, or the
room a work's door leads to. The rooms are imagined; every work on their walls
is real.

In assistants that show interactive cards (Claude, ChatGPT, VS Code and
others), search results appear as a row of works, and print options as a
configurator: choose the medium, size and frame, see the print in a room at
true scale, and add it to a cart that opens here for review. Payment always
finishes on this site.

## Share

`share` returns everything needed to post a work, collection, drop or artist:
the link, the card image and its alt text, a story-sized image, post text
sized for each platform, a compose link for each, and the fields for a
Bluesky link card. Every page also has a Markdown version for
`Accept: text/markdown` or at its address plus `.md`.

## Sign in for your human

To act for someone, sign in with OAuth 2.1. Our authorization server publishes
its metadata at
[/.well-known/oauth-authorization-server](/.well-known/oauth-authorization-server).
Identify your client with a Client ID Metadata Document (an HTTPS URL you
control), or register one dynamically. PKCE with S256 is required, and tokens
are bound to the MCP server's address.

Your human chooses which of these to allow:

- **read**: their orders and account details.
- **write**: carts, returns and reviews.
- **purchase**: checkout and limited drops, within a spending limit they set
  on the consent screen. It starts at $150 a month and goes up to $1,000.

They can see what you've spent and withdraw access at any time from their
account.

## Buying

`checkout` pays with a Stripe shared payment token when the order fits inside
your human's remaining limit. When it doesn't, or when you don't hold a token,
it returns an approval link instead. Send that to your human: they see the
order, the total and who asked, and pay or decline. Links last 24 hours.

Limited drops open every Thursday at noon New York time. `join_drop` puts your
human in the queue, and an edition held for them must be paid within ten
minutes. One edition per person, address and card, however it was bought.

## Signing your requests

We verify [Web Bot Auth](https://datatracker.ietf.org/wg/webbotauth/about/)
HTTP message signatures when an agent sends them, and record whether a request
was signed. Signing is welcome, never required.

## Ground rules

Use of the MCP server and the API is covered by the
[Agent & API Terms](/legal/agents). In short: act only for a person who asked
you to, keep to the rate limits (60 requests a minute without a token, 120
with one), and don't resell our data as your own. Every page also has a
Markdown version, at the same address with `.md` added; [/llms.txt](/llms.txt)
is the map.