Algor exposes a remote Model Context Protocol server at https://algor.world/api/mcp (Streamable HTTP, stateless). Any MCP client can connect with either a personal API key or an OAuth 2.1 login. The same permissions apply to the REST API when you send an Authorization: Bearer header.

• Read-only by default: markets, sports, portfolio, wallet balances.
• Opt-in money scopes: bets:write (with a daily stake cap) and plan:write.
• Never available to agents: withdrawals, wallet linking, profile changes, chat history.

API keys are the quickest route for Cursor, Claude Code, scripts and CI. Create one under Settings → Agent access, pick scopes, and send it as a bearer token. Keys start with algor_sk_ and are shown once.

OAuth 2.1 is for hosted assistants that log users in themselves (Claude.ai connectors, ChatGPT). Algor is its own authorization server: discovery lives at https://algor.world/.well-known/oauth-authorization-server, PKCE (S256) is mandatory, clients register dynamically or via an https:// client-ID metadata URL, and users approve scopes plus a stake cap on the consent screen at /oauth/authorize. Access tokens last an hour; refresh tokens rotate and last 30 days.

# Discovery
GET https://algor.world/.well-known/oauth-protected-resource
GET https://algor.world/.well-known/oauth-authorization-server

# Endpoints
POST https://algor.world/api/oauth/register   # RFC 7591, public clients
GET  https://algor.world/oauth/authorize      # consent page
POST https://algor.world/api/oauth/token      # authorization_code (PKCE) | refresh_token
POST https://algor.world/api/oauth/revoke     # RFC 7009

Every token with bets:write carries a daily stake cap in USD (default $100). Stakes are reserved against the cap before the ledger is debited and released if booking fails; hitting it returns CAP_EXCEEDED. Plan quotas for ask_algor are shared with the website and reported in X-Algor-Remaining headers. Tokens cannot mint other tokens.

Add to .cursor/mcp.json (project) or ~/.cursor/mcp.json (global) with an API key:

{
  "mcpServers": {
    "algor": {
      "url": "https://algor.world/api/mcp",
      "headers": { "Authorization": "Bearer algor_sk_..." }
    }
  }
}

Or omit headers and Cursor will run the OAuth flow in your browser the first time it connects.

# API key
claude mcp add --transport http algor https://algor.world/api/mcp \
  --header "Authorization: Bearer algor_sk_..."

# OAuth (browser consent on first use)
claude mcp add --transport http algor https://algor.world/api/mcp

Settings → Connectors → Add custom connector. Enter https://algor.world/api/mcp and leave the client fields blank; Claude registers itself and opens the Algor consent page. Alternatively paste an API key as a static Authorization header where the connector UI allows it.

Enable Developer mode (Settings → Connectors → Advanced), then Create a connector with the MCP server URL https://algor.world/api/mcp and authentication set to OAuth. ChatGPT discovers our metadata, registers dynamically, and the user approves scopes on the consent page. Tools marked read-only run without confirmation; place_bet and buy_max prompt the user each time.

Clients that only speak stdio can bridge with mcp-remote:

{
  "mcpServers": {
    "algor": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://algor.world/api/mcp",
               "--header", "Authorization: Bearer algor_sk_..."]
    }
  }
}

Resources: algor://docs/quickstart (this guide, condensed) and algor://market/{id}. Every tool returns both a text summary and structuredContent JSON; failures set isError with a stable code.

// place_bet arguments
{
  "legs": [{ "marketId": "…", "event": "Arsenal vs Spurs", "outcome": "Arsenal", "decimalOdds": 2.1 }],
  "stakeUsd": 10,
  "idempotencyKey": "my-agent-run-42"   // retries with the same key return the same position
}

The JSON API the website uses accepts the same tokens. Scope rules are identical.

curl -s https://algor.world/api/auth/me \
  -H "Authorization: Bearer algor_sk_..."

curl -s https://algor.world/api/compose \
  -H "Authorization: Bearer algor_sk_..." -H "Content-Type: application/json" \
  -d '{"text":"Arsenal to win this weekend, $10"}'

curl -s https://algor.world/api/bets \
  -H "Authorization: Bearer algor_sk_..." -H "Content-Type: application/json" \
  -d '{"legs":[{"marketId":"…","event":"…","outcome":"…","decimalOdds":2.1}],"stakeUsd":10,"idempotencyKey":"run-42"}'

Read endpoints: /api/portfolio, /api/bets, /api/wallet/summary, /api/wallet/deposits, /api/plan. Write: POST /api/bets (bets:write), POST /api/plan (plan:write). Human-only endpoints return 403 HUMAN_ONLY for any token.

• 401 — missing or invalid token. MCP responses include a WWW-Authenticate header pointing at the protected-resource metadata.
• 403 SCOPE_DENIED — token lacks the scope for this action.
• 403 HUMAN_ONLY — action requires a browser session (withdrawals, wallet linking, profile).
• 403 CAP_EXCEEDED — stake would exceed the token's daily cap; the response carries remainingUsd.
• 402 INSUFFICIENT_FUNDS — balance too low; deposits are human-only, so surface depositUrl to the user.
• 429 — plan quota reached; see retryAfterSec and upgradeUrl.

Questions or a client that doesn't fit these recipes? hello@algor.bet