Use the GST MCP Server from code

01 Before you start

You need a client ID and a client secret. The free 3-day trial issues a pair in one click; anything wider is provisioned by GST. There is no dynamic client registration.

What the credential is

An OAuth 2.1 client_credentials client. The secret is shown once when it is issued and is bearer-equivalent: keep both values in a secret store or in environment variables, never in a committed file or a shell command.

What it is not

It does not drive Claude, Cursor or ChatGPT. Those clients authenticate a person through the consent page with a trial key or an operator-issued key, and there is no config-file or custom-header way to make them use this credential. For that path, use the connector guide.

Open the connector guide →

Three ways to authenticate at the token endpoint

Send client_id and client_secret in the form body, as shown below, or as HTTP Basic (client_secret_basic). A provisioned client can register an ES256 public key and use private_key_jwt instead, so no shared secret leaves your infrastructure; ask GST when the client is created.

02 Exchange the credential for a token

POST a form-encoded body to the token endpoint. Use this URL directly: the server's OAuth discovery document describes the connector flow and does not list client_credentials, so do not rely on a library to find it.

Token endpoint

Request

# Export the pair from your secret store; never paste it inline
curl -s -X POST https://mcp.globalstrategic.tech/token \
  -d grant_type=client_credentials \
  -d client_id="$GST_CLIENT_ID" \
  -d client_secret="$GST_CLIENT_SECRET"

Response

{ "access_token": "mcp_m2m_...", "token_type": "bearer", "expires_in": 3600, "scope": "..." }

access_token is the bearer you send on every call. expires_in is in seconds: 3600, one hour. token_type is lowercase bearer on the wire. There is no refresh token in this response, and there will not be one.

401 invalid_client: Client credentials have expiredThe client record has lapsed. For a trial that means the 72 hours are over; signing up again on the same network replaces the pair. Any other 401 at this step means the ID or secret is wrong.

03 Call the server

Send JSON-RPC 2.0 to /mcp with the token in Authorization: Bearer. The Accept header must list both application/json and text/event-stream: the transport is Streamable HTTP and rejects a request without it.

A smoke test: list the tools

curl -s -X POST https://mcp.globalstrategic.tech/mcp \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

Expect a result.tools array naming the sixteen diligence, portfolio and regulatory tools. Call one with tools/call and its arguments; every contract is in the capability reference.

Open the capability reference →

Using an MCP SDK

The official MCP SDKs speak this transport natively: point the Streamable HTTP client at the endpoint and give it the client ID and secret through the SDK's ClientCredentialsProvider. The SDK then performs the exchange above and repeats it when the token expires.

Radar tools are refused on a trialA trial credential cannot call the radar tools. The call returns JSON-RPC error -32002 inside an HTTP 200, not a transport failure. Radar is granted separately with a provisioned client.

04 Keep it running

The token expires every hourThe token is not the credential. It lasts one hour and there is no refresh token: when a call returns 401, repeat step 02 and continue. Store the client ID and secret, mint tokens on demand, and never persist a token as if it were the key. A 401 from the token endpoint itself means the credential has expired.

Trial ceilings

A trial credential works for 72 hours at 15 calls per minute and 100 per day. Non-contractual capacity limits, not an SLA. A 429 carries a Retry-After header; back off for that long rather than retrying immediately.

After the trial ends

The token exchange and every call return 401. Delete the pair from your secret store. For continued access, request an evaluation licence: a provisioned client keeps the same two-step flow with wider scopes and higher ceilings.

05 Where to go next

Three routes on from a working call: every tool's contract, the interactive path, and a wider grant.