# Tailorgame API and MCP

## REST

Base URL: https://tailorgame.com
OpenAPI: https://tailorgame.com/openapi.json
API catalog: https://tailorgame.com/.well-known/api-catalog

Public reads:

```sh
curl --fail 'https://tailorgame.com/api/games'
curl --fail 'https://tailorgame.com/api/rankings'
```

Account routes retain verified sessions and ownership checks. Consult the OpenAPI operation security requirements and [authentication documentation](https://tailorgame.com/auth.md) before use. Public reads require no key. There is no production sandbox endpoint; local development uses the demo-tailorgame Firebase Auth and Firestore emulators, never live user data.

## Errors and retries

REST failures return JSON {error: string} with an HTTP status. 400 means invalid input, 401 means sign-in required, 403 means forbidden request or origin, 404 means unknown or inaccessible object, and 503 means temporarily unavailable. Retry public reads after a short delay on 503. Do not repeatedly retry authentication or validation errors, or replay a credit-spending write without checking its documented request ID semantics. No public rate-limit guarantee or uptime SLA is published.

## Read-only MCP

Endpoint: https://tailorgame.com/mcp
Transport: Streamable HTTP, protocol 2025-11-25, stateless JSON responses. POST requires application/json and an Accept header containing application/json and text/event-stream. GET returns 405 because the server does not offer an SSE listener. Browser Origin headers must match a configured Tailorgame origin; non-browser clients can omit Origin. No cookies or credentials are used.

```json
{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-11-25","capabilities":{},"clientInfo":{"name":"example-client","version":"1.0"}}}
```

After notifications/initialized, send MCP-Protocol-Version: 2025-11-25 on subsequent requests and call tools/list, then tools/call. Available tools: list_games (query, category, limit), get_rankings (no arguments), and get_documentation (topic: overview, authentication, pricing, games, or api). Tools validate arguments, expose only public information, and return text plus structuredContent. Documentation is also available through resources/list and resources/read. Unknown methods return JSON-RPC -32601; invalid arguments return -32602. Operational tool failures use isError: true without leaking internal exceptions. No account mutations or payments are exposed.

```json
{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"list_games","arguments":{"query":"bowling","limit":5}}}
```

## Browser tools

Compatible browsers can discover read-only WebMCP tools for the public catalog, rankings and documentation. The website feature-detects WebMCP; normal browsing works without it. These tools omit credentials on API calls, even when the browser is signed in.

Updated: 2026-11-05.

## Resources

- [Documentation](https://tailorgame.com/docs)
- [OpenAPI 3.1](https://tailorgame.com/openapi.json)
- [Documentation index](https://tailorgame.com/llms.txt)
- [Authentication](https://tailorgame.com/auth.md)
- [Pricing](https://tailorgame.com/pricing.md)