Connect a client

Every client below speaks HTTP MCP with a bearer header. Replace mxt_… with the token from your account page. The endpoint is https://buyer.moxlade.com/mcp/ — with the trailing slash; without it the server answers 307, which some clients turn into a silent failure.

claude mcp add --transport http moxlade https://buyer.moxlade.com/mcp/ \
  --header "Authorization: Bearer mxt_…"

codex mcp add moxlade --url https://buyer.moxlade.com/mcp/ --bearer-token-env-var MOXLADE_TOKEN
export MOXLADE_TOKEN=mxt_…
codex exec "search_jobs for the work you do, then get_buyer_quality on the best one."

{
  "mcpServers": {
    "moxlade": {
      "url": "https://buyer.moxlade.com/mcp/",
      "headers": {
        "Authorization": "Bearer mxt_…"
      }
    }
  }
}

{
  "servers": {
    "moxlade": {
      "type": "http",
      "url": "https://buyer.moxlade.com/mcp/",
      "headers": {
        "Authorization": "Bearer mxt_…"
      }
    }
  }
}

gemini mcp add --transport http moxlade https://buyer.moxlade.com/mcp/ \
  --header "Authorization: Bearer mxt_…"

{
  "mcpServers": {
    "moxlade": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://buyer.moxlade.com/mcp/",
        "--header",
        "Authorization:${AUTH}"
      ],
      "env": {
        "AUTH": "Bearer mxt_…"
      }
    }
  }
}

curl -s -X POST https://buyer.moxlade.com/mcp/ \
  -H "Authorization: Bearer mxt_…" \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -H 'MCP-Protocol-Version: 2026-07-28' \
  -H 'Mcp-Method: tools/list' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{"_meta":{
        "io.modelcontextprotocol/protocolVersion":"2026-07-28",
        "io.modelcontextprotocol/clientCapabilities":{},
        "io.modelcontextprotocol/clientInfo":{"name":"curl","version":"0"}}}}'

Any other client

Any client that accepts a Streamable HTTP MCP server with a custom header works the same way: URL https://buyer.moxlade.com/mcp/, header Authorization: Bearer mxt_…. The shapes for Windsurf, Cline, Roo, Goose and Copilot CLI are analogous to the Cursor and VS Code JSON above.

Or connect with OAuth — no token to paste

The endpoint is an OAuth 2.1 resource server. A client that speaks the MCP authorization spec needs nothing but the URL https://buyer.moxlade.com/mcp/: it gets a 401 carrying WWW-Authenticate, follows resource_metadata to our protected-resource document, finds the authorization server, registers itself, and sends you to sign in. There is no client id to create and no secret to store.

OAuth and a pasted token land on the same account. Sign in with the address you minted under and you keep one plan, one trial end date and one history — connecting a second way does not start a second trial.

Clients whose panel takes OAuth and not a header

The dividing line is the interface, not the vendor. A one-click connector panel with no header field cannot take a bearer token; the same vendor's config file usually can, which is why Claude Desktop is in the list above. Those panels speak OAuth, which this endpoint now does.

• claude.ai custom connectors (web) — its Advanced settings take an OAuth client id and secret and no bearer header, which is why a token could not be used here. Our authorization server now supports dynamic client registration, so no id or secret has to be entered by hand (server side verified; this client not yet tried against this endpoint)
• ChatGPT connectors — documented as supporting OAuth and as not able to present a custom API key (server side verified; this client not yet tried against this endpoint)

Read those confidence notes literally. The server side is verified end to end against production — discovery, registration, consent, an audience-bound token, and a real tools/call. Whether a particular vendor's panel drives that correctly is a different claim, and we have not tried these two. If one fails, write to us with what it said.

First calls

1. get_plan — what your token is allowed to do right now, and how long a trial has left. Answers on every plan state.
2. rate_benchmark with a skill you know — the p25/median/p75/p90 of listed rates, or an honest "too few" below five freelancers.
3. search_jobs with a phrase — compact public postings, one page at a time; next_cursor walks the rest of what matched.

Reading a result: every tool returns result.structuredContent — the answer as data, matching the tool's outputSchema, so you can validate it before using it. A list arrives under structuredContent.result; an object is structuredContent itself. result.content[0].text carries the same thing as JSON text for clients that only read content. A refused or failed call is result.isError: true with the reason in the text; the HTTP status stays 200.