MCP server
Cru runs a Model Context Protocol server, so a Cru customer can use their own account from Claude, ChatGPT and other AI assistants: find wines, read both sides of the market, review their portfolio, bids, listings and trades — and, if they allow it, bid, buy, list and sell, each confirmed by them in the conversation.
https://us.cruworldwine.com/api/mcpConnect an assistant
Add Cru to Claude, Claude Code or ChatGPT, and choose what it may do.
REFERENCE27 tools
14 to read, 13 to trade: inputs, scopes and REST equivalents.
1 / 5Claude connects with nothing but the URL, signed in as the customer. tools/list returns only the tools they allowed.
Who it is for
The MCP server is for customers, each connecting their own Cru account through an assistant they already use. It signs in with OAuth on Cru’s site, so the assistant never sees a password and gets only the permissions the customer ticks. Partners integrating a business server-to-server should use the REST API, which the tools are built on: every tool reads from the same place as its REST endpoint, with the same prices and rules.
One connection per market
Every market’s host serves the server at /api/mcp. The host decides the market, and with it the currency of every price, the site product links point at and the site a trade is placed on. To use two markets, add two connectors.
| MARKET | CURRENCY | PRODUCTION MCP URL |
|---|---|---|
| United Kingdom | GBP | https://uk.cruworldwine.com/api/mcp |
| United States | USD | https://us.cruworldwine.com/api/mcp |
| Hong Kong | HKD | https://hk.cruworldwine.com/api/mcp |
| Singapore | SGD | https://sg.cruworldwine.com/api/mcp |
| Europe | EUR | https://eu.cruworldwine.com/api/mcp |
| United Arab Emirates | AED | https://ae.cruworldwine.com/api/mcp |
Trading needs the customer’s yes
The trading tools never trade. Each prepares an instruction and returns a one-sentence summary and a confirmation code; only confirm_instruction carries it out, and the assistant is told to call it only after the customer says yes in the conversation. A code lasts 15 minutes and works once.
A trade, from request to done
4 STEPSThe customer
The customer asks for a trade
“Bid £1,650 for a case of Lafite 2024.” The assistant finds the wine and its market first.
The assistant
The assistant prepares the instruction
MCP place_bidA trading tool only stages: it returns a one-sentence summary and a confirmation code, and changes nothing.
KEEP
confirmation_code, summaryThe customer
The customer reads the summary and says yes
In the conversation. There is no email or website step: the yes in the chat is the confirmation, so the assistant is told never to confirm on anything else’s say-so.
The assistant
The assistant confirms it
MCP confirm_instructionWithin 15 minutes, once. Cru re-checks the price and availability, and executes exactly what was staged.
Trading tools appear only if the customer ticked the trading permissions when connecting — they start unticked. How confirmation works →
Partner keys are the exception: called with them, a write tool is carried out at once, as over REST, and takes a reference. With partner keys →
Protocol
| Transport | Streamable HTTP: POST only, one JSON-RPC message per request, JSON responses. No server-sent events, no sessions — every request stands alone, and no Mcp-Session-Id is issued. |
| Versions | 2026-07-28, 2025-11-25, 2025-06-18, 2025-03-26 — the stateless 2026-07-28 revision and the three before it. The 2024 HTTP+SSE transport is not supported. |
| Capabilities | Tools only. No resources, prompts or sampling. tools/list returns just the tools the connection’s permissions allow. |
| Server | cru-world-wine “Cru World Wine” 1.0.0, with instructions for the assistant — below. |
| Limits | 60 tool calls a minute per connection; bodies up to 1 MiB; no batches. A call over the limit returns a tool error saying when to try again. |
| Browsers | No CORS. A request with an Origin header is refused unless it is the server’s own host or localhost, so an inspector must run locally. |
What the assistant is told
The server hands every assistant these instructions when it connects:
Cru World Wine is a fine wine marketplace. These tools read its live market for the signed-in customer, quoted in the currency of their market. Wines are identified by LWIN18 (wine, vintage and pack size): find them by name with search_wines, then use list_offers for what a wine would cost to buy, list_bids for what it could be sold for, or list_market for both. Bid prices are net of Cru's commission. Every price is a normal amount in the stated currency. If the customer allowed it, the bid, buy, listing and sell tools prepare an instruction that only happens when confirm_instruction is called after the customer agrees, unless the tool says it is carried out straight away. Anything else the customer does on the Cru website, which product_url links to.
Signing in
An assistant connects with nothing but the URL. Its first request gets 401 and a WWW-Authenticate header naming /.well-known/oauth-protected-resource/api/mcp; from there it finds Cru’s authorization server, registers itself, and sends the customer to Cru’s consent page. The OAuth flow in full →
The connection then lasts while the assistant keeps refreshing its token — 30 days from its last use. If the customer’s account goes on hold, it stops.
Errors
| Refused before the protocol | 401 to sign in, 403 with access_denied for an account on hold or a market the customer did not allow, 403 for plain HTTP or a browser Origin Cru does not allow, 405 for anything but POST, and 413 for an oversized body. |
| Protocol errors | JSON-RPC errors: -32700 parse error, -32600 invalid request (and a tool the connection was not granted, with a 403 naming the scope), -32601 unknown method, -32602 bad parameters or unknown tool, -32603 an internal error, -32022 a protocol version Cru does not support, listing the ones it does, and, on version 2026-07-28, -32020 when a header is missing or disagrees with the body: MCP-Protocol-Version, Mcp-Method, and Mcp-Name for a tool call. |
| Tool errors | A bad argument, a refused trade, a price that moved: a normal result with isError: true and the reason as text, so the assistant can read it and try again differently. |
The MCP server is enabled with connected apps, environment by environment. Where it is not yet, /api/mcp answers 404.