# Stablecoin Roadmap for Claude and Codex

Use Stablecoin Roadmap to plan a stablecoin network, inspect provider capabilities, research licensing requirements, and read your organization's compliance and operation records.

This guide describes the source release. After connection, use `tools/list` to confirm the deployed tool set. A listed tool still requires its own permissions.

## Connect

Endpoint: `https://www.stablecoinroadmap.com/api/mcp`

Transport: Streamable HTTP. Interactive authentication: OAuth authorization code with PKCE. Use your existing Supabase account and magic-link login. API keys remain available for unattended scripts.

### Sign in from your client

After the operator enables OAuth, Codex users can run:

```sh
codex mcp add stablecoin --url https://www.stablecoinroadmap.com/api/mcp
codex mcp login stablecoin
```

Claude Code users can run:

```sh
claude mcp add --transport http stablecoin https://www.stablecoinroadmap.com/api/mcp
```

Open `/mcp` in Claude Code and complete the server's authentication flow. In the browser, sign in with your existing account, review the client and requested access, and select **Allow access**. Research access does not require an organization. For private reads, select an organization; current permissions and requested scopes must allow the read.

Open the magic link in the same browser that started consent. If the email opens in another browser or more than ten minutes pass, restart the connection from the client. Existing account-access restrictions still apply; OAuth does not automatically approve a pilot account.

Access tokens last ten minutes. Refresh tokens rotate and are bounded by a thirty-day connection lifetime, session revocation, and organization policy. Reusing a code or refresh token revokes its connection family. If a token response is lost, reconnect rather than retrying the consumed grant indefinitely.

Manage or revoke connections at `/mcp/connections`. No Supabase session or refresh token is shared with the MCP client.

For a Codex connection that also reads organization compliance records, request the private read scopes explicitly:

```sh
codex mcp login stablecoin --scopes mcp:read,providers:read,compliance:read,deployment:read
```

Select the organization on the consent page. The listed scopes do not create organization permissions. Audit reads additionally require `analytics:read` and the current `audit.read` permission.

If discovery returns `503`, OAuth has not been configured or its service is unavailable. Ask the operator to enable the OAuth release; do not assume a source update has enabled it in production.

### API-key fallback

Obtain an active organization-bound production credential with `mcp:read` from your organization administrator. Additional scopes are listed below. Make `STABLECOIN_MCP_TOKEN` available in the environment of the client process. Do not paste the secret into chat or commit it to a repository.

For Codex, run:

```sh
codex mcp add stablecoin --url https://www.stablecoinroadmap.com/api/mcp --bearer-token-env-var STABLECOIN_MCP_TOKEN
```

For Claude Code, add this entry to `.mcp.json`. Merge it with existing servers. The token placeholder is expanded by Claude Code:

```json
{
  "mcpServers": {
    "stablecoin": {
      "type": "http",
      "url": "https://www.stablecoinroadmap.com/api/mcp",
      "headers": { "Authorization": "Bearer ${STABLECOIN_MCP_TOKEN}" }
    }
  }
}
```

Restart or reconnect the client, then ask: **“Use Stablecoin Roadmap's get_service_guide. Show what I can do and what access each workflow needs.”**

These instructions target Codex and Claude Code. Other Claude clients can have different connector authentication requirements. Check the client's supported authentication before using this configuration.

Configuration references: [Codex MCP](https://developers.openai.com/codex/mcp) and [Claude Code MCP](https://code.claude.com/docs/en/mcp).

## Try these workflows

| Ask your agent | Tools | Result and limit |
| --- | --- | --- |
| Plan a stablecoin payout stack for my business and identify missing dependencies. | `plan_stack`, `list_capabilities`, `get_capability` | A capability plan, not a deployed app. |
| Show licensing requirements for my target jurisdiction and cite the sources. | `list_jurisdictions`, `get_jurisdiction`, `list_frameworks`, `list_license_classes`, `get_license_requirements`, `get_evidence_source` | Catalog coverage, versioned requirements, and sources. Missing coverage stays explicit. |
| What captured regulatory updates affect this framework since a date? | `get_regulatory_updates`, `check_framework_delta` | Public bulletins, not a continuous global monitoring guarantee. |
| Which provider manifests support the capabilities I need? | `stablecoin.providers_registry`, `stablecoin.providers_matching` | Builtin manifests, including mocks. A match does not establish legal or corridor eligibility. |
| What licenses, deadlines, and captured changes need attention in my organization? | `stablecoin.compliance_workspace`, `stablecoin.compliance_licenses`, `stablecoin.compliance_changes`, `stablecoin.compliance_jurisdictions` | Recorded organization data and review states. Supply `organizationId`; follow pagination. |
| Show the current state of my corridor workflow and the organization's audit history. | `stablecoin.payments_corridor_workflow_status`, `stablecoin.organization_audit_history` | Platform state and audit records. Status does not prove settlement. |
| Submit a request for this missing catalog coverage. | `report_gap` | Creates a feedback record for review. This is the only write in this hosted release. |

The hosted source release contains 21 tools: 12 catalog tools, seven gateway reads, organization audit history, and the service guide.

## Access requirements

Every hosted call requires `mcp:read` in an OAuth consent grant or on an active production API credential. OAuth private reads use production organization context. Research-only OAuth does not grant private access.

| Read | Additional access |
| --- | --- |
| Provider manifests | `providers:read` |
| Compliance workspace and collections | `compliance:read`, `deployment:read`, and current organization permissions for both domains. Production workspace only. |
| Organization audit history | `analytics:read` and current organization `audit.read` permission |
| Corridor workflow status | `payments:read` and the API key that originally started the workflow. A replacement key does not inherit the status record. |

If access fails, ask the administrator to review the specific permission. Do not retry with another organization's ID. If the service returns `429`, wait before retrying. If it returns `503`, the operator must check service configuration or availability. A missing tool after connection can mean that the hosted deployment predates this guide.

## Current execution boundary

Project/app changes, contract generation and deployment, payment execution, mint/burn, provider invocation, license changes, packet compilation, membership changes, and approvals are not exposed as hosted MCP commands in this release. Existing API routes or provider manifests do not make those functions callable tools.

Use documents and conversation history in your agent client. Server document upload, connector management, skill installation, and conversation persistence are not part of this tool set.

The local `@stablecoin/agent-gateway` package remains a separate eight-read-tool transport in source. It does not include the hosted catalog or service guide. Prefer the hosted endpoint for the combined journey. Package publication and hosted deployment are separate release steps.