MCP
Reach a brand's catalog from an AI assistant, as the person using it.
The Fabric MCP server exposes a brand's catalog to an AI assistant through the Model Context Protocol. An assistant connected to it can search products, correct values, run enrichment and start exports. It acts as the person who authorized it, with exactly that person's permissions.
Not yet reachable
The server is built but not switched on yet. The endpoint starts answering once the connection details below are live. This page describes the server as it is built.
How it authenticates
The server uses OAuth 2.1, not an API key. An assistant has no credential of its own. It sends the user to Fabric, the user signs in and approves a list of scopes, and the assistant receives a token bound to that user, those scopes and this server.
As a result:
- A tool cannot do more than the person can. Every call uses the person's token and goes to the same API a person uses.
- The user approves each scope. The consent screen describes each scope in plain language, and the user can deny any of them.
- The token works only on this server. A token issued for another resource is refused, even if it is valid there.
Scopes
| Scope | What an assistant may do |
|---|---|
catalog:read | Read products, categories, attributes, views and lists |
catalog:write | Edit values, images and FAQ answers; move products through review |
enrichment:write | Start enrichment runs, which spend credits |
publishing:read | See destinations, mappings and publishing history |
publishing:write | Publish to connected destinations |
org:read | See the organization and its brands |
org:write | Manage brands, members and keys |
Grant only the scopes the assistant needs. With enrichment:write it can spend money. With only
catalog:read it cannot change anything.
Brand IDs
There is no active brand and no default. A token identifies a person, and a person may belong to
several brands, so each tool takes an explicit brandId.
A brandId the user cannot reach returns not found, not forbidden, so the server never
confirms that an id exists.
Start with list_brands
It is the only tool that takes no brandId. It returns every brand you can act on, with the
organization each one belongs to.
Discovering the server
A client needs only the MCP endpoint URL and discovers the rest itself, as described in
RFC 9728. An unauthenticated request returns 401
with the location of the metadata:
WWW-Authenticate: Bearer resource_metadata="https://fabric.inc/.well-known/oauth-protected-resource/api/mcp"That document names the authorization server, the resource identifier your token must be bound to, and the scopes above. A compliant client needs nothing else from you.