Run your auctions from Claude.

What you can do from chat.

"Approve all lots above 0.85 confidence." Your assistant calls list_lots with status=review, then loops approve_lot for each lot where confidence ≥ 0.85. Every approval lands as a :AuditEvent in your tenant graph with the API key that triggered it.

Set up in three steps.

1. Generate an API key

From your admin shell: Settings → API keys → Create. Copy the plaintext (shown once):

hw_henderson-auctions_a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4

2. Wire it into your assistant

Claude Desktop — edit ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

{
  "mcpServers": {
    "hammerwerks": {
      "command": "npx",
      "args": ["@hammerwerks/mcp"],
      "env": { "HAMMERWERKS_API_KEY": "hw_…" }
    }
  }
}

Cursor — add to ~/.cursor/mcp.json with the same structure as above.

Custom GPT (ChatGPT) — create a custom GPT, add an action with the OpenAPI spec at https://api.hammerwerks.com/mcp/openapi.json, and configure Bearer auth with your key.

3. Ask

• "List my open auctions."
• "How many lots in the Spring Sale haven't been approved yet?"
• "What's the sell-through rate on auction auc_xxx?"
• "Approve all lots in review status with AI confidence above 0.85."

Security model.

Every write tool (create_auction, approve_lot, update_lot, record_payment) emits a :AuditEvent node in your tenant graph tagged with action: 'mcp.<tool_name>', the API key ID that triggered it, and the parameters. Query the audit log via the standard /api/audit route to see exactly what an assistant did.

Revoke a key from Settings → API keys, or DELETE /api/mcp-keys/<apiKeyId>. Revoked keys reject immediately at auth; existing in-flight requests complete but no new requests succeed.

API key format: hw_<auctioneerId>_<32-hex-secret>. The secret is sha256-hashed before storage; the plaintext is shown once at creation and never persisted. See the security page for the full architecture.

FAQ.

Can an assistant delete an auction?

No. There is no delete_auction tool. Destructive operations (delete, cancel, refund) are deliberately not exposed via MCP in v1 — they require the admin UI. Auctions can be paused and lots can be unapproved, but nothing is actually deleted through the MCP surface.

How are tool arguments validated?

Every tool has a strict inputSchema with required fields and enum validation. Invalid arguments are rejected with a JSON-RPC error before the handler runs. Tool descriptions in the spec are written for clarity — they tell the model exactly when to use each one.

Can I use multiple API keys for different assistants?

Yes — issue as many keys as you want, with role-tagged names ("Claude desktop", "Kim's Cursor", etc.). Every key's actions are individually attributable in the audit log.