Connect VehiclePhoto to Claude, Cursor and any MCP client

Ask an agent to send a vehicle photo, start one processing step and return a signed result without leaving your client. The live Streamable HTTP endpoint uses the same scoped bearer keys and account boundaries as REST v1.

Authentication

Use one scoped key

Sign in, then mint a key in API keys. Copy the secret when it appears because it is shown once.

Choose ingest when the agent should send a public image URL, process when it should start a recipe step, and read when it should retrieve known photos or jobs. whoami needs no additional scope after the key itself has authenticated.

Pass the one-time secret as Authorization: Bearer <KEY> on the Streamable HTTP request. Authentication uses an API key today; this endpoint does not advertise OAuth. A missing, invalid or revoked key returns HTTP 401 with WWW-Authenticate: Bearer.

The key resolves to one account boundary before the protocol handler reads the request. Tool-specific scope checks happen again at dispatch, so a valid read-only key cannot ingest or process a photo.

Keep the secret in the MCP client configuration or its secret mechanism, never in a shared file. If a key is exposed, mint a replacement in the app, update each client, and revoke the old key.

1. Step 1

   Create a scoped key

   Sign in, open API keys, create a named key with read, ingest and process only when those operations are needed, and copy the secret shown once.

2. Step 2

   Add the endpoint

   Configure https://vehiclephoto.com/api/mcp as a remote Streamable HTTP server and send the key in the Authorization header.

3. Step 3

   Verify the boundary

   Ask the client to call whoami first. Check the returned account boundary, key ID and scopes before asking it to work with a photo.

4. Step 4

   Try one workflow

   Begin with a public image URL, keep the returned image ID, request one processing step, then poll the returned job ID until a signed result is available.

claude mcp add --transport http vehiclephoto https://vehiclephoto.com/api/mcp --header "Authorization: Bearer <KEY>"

{
  "mcpServers": {
    "vehiclephoto": {
      "type": "http",
      "url": "https://vehiclephoto.com/api/mcp",
      "headers": {
        "Authorization": "Bearer <KEY>"
      }
    }
  }
}

{
  "mcpServers": {
    "vehiclephoto": {
      "url": "https://vehiclephoto.com/api/mcp",
      "headers": {
        "Authorization": "Bearer <KEY>"
      }
    }
  }
}

Examples

Try these prompts

• “Verify this VehiclePhoto connection and tell me which scopes it has before taking any action.”
• “Ingest this public vehicle-photo URL, attach the VIN I provide, and return the new image ID.”
• “Run the background_replace capability on this image ID with one recipe step, then give me the job ID.”
• “Check this job ID. If it has finished, return the signed result URL and summarize the status without changing anything else.”
• “Retrieve this photo ID with a small page size and explain which returned URL is temporary.”

Boundaries

Know the limits

The MCP endpoint shares the REST limiter: 60 authenticated requests per 60-second window for each key. One token is spent before MCP dispatch. When the bucket is empty, the server returns HTTP 429 and Retry-After.

The server is stateless Streamable HTTP. It does not open a long-lived GET stream, accept subscription streams, or keep protocol sessions between requests; each POST carries the context needed for that exchange.

The registry exposes five operations and one OpenAPI resource. It does not expose inventory-wide list tools. get_asset and get_job require supplied IDs, while process_image accepts one supplied recipe step for one previously imported image.

ingest_image_url accepts a public URL and retains the same server-side URL safety checks as REST v1. Private, loopback, link-local and multicast destinations are refused before an image is fetched.

Processing still follows the account credit and trial rules. A tool error is returned as structured MCP error content; transport authentication and rate-limit failures remain HTTP 401 or 429 responses.

Sources

• https://vehiclephoto.com/api/mcp — VehiclePhoto Streamable HTTP MCP endpoint; authenticated POST requests expose the registry documented above.
• https://vehiclephoto.com/api/v1/openapi.json — The REST v1 OpenAPI document also served by the MCP openapi resource.

Keep exploring