# TreatLog MCP server

Remote MCP over HTTP for pesticide application logging, state usage worksheets, and audit pack exports — same confirm-gated rules as the TreatLog UI.

## Endpoint and auth

- **URL:** `POST https://treatlog.com/api/mcp` (Streamable HTTP — include `Accept: application/json, text/event-stream`)
- **Auth:** `Authorization: Bearer <api_key>` (prefix `tl_test_` for demo / `tl_live_` for production keys)
- **OAuth discovery:** RFC 9728 PRM at https://treatlog.com/.well-known/oauth-protected-resource/api/mcp; unauthenticated probes receive **HTTP 401** with `WWW-Authenticate` `resource_metadata`. **Machine auth today:** Bearer API keys (`tl_test_` / `tl_live_`). OAuth authorization-server metadata is published for client discovery; exchange flows land on org API keys in Settings until OAuth clients GA.
- **Registry:** `server.json` name `com.treatlog/mcp` (DNS-verified `com.treatlog` namespace for treatlog.com)
- **Smithery:** optional card at https://treatlog.com/.well-known/mcp/server-card.json; `SmitheryBot` allowed in `robots.txt`
- **Org keys:** issued per workspace in Settings after signup. The shared seeded demo does not publish agent API keys.

## Core tools (Pro writes are confirm-gated)

| Tool | Purpose |
| --- | --- |
| `log_application` | Create a treat log with products, areas, applicator |
| `generate_state_usage_report` | CA monthly-summary worksheet or NY Form 26 extract; `dry_run` defaults **true**; never files with agencies |
| `export_audit_pack` | ZIP of application PDFs, license CSV, demo SDS/label PDFs (not manufacturer files) |

Additional read tools: `list_applications`, `get_application`, `list_products`, `get_compliance_calendar`, `list_ask_board`, etc.

## Safety limits

- No automatic submission to county ag commissioners, DEC, TDA, FDACS, WSDA, or other agencies
- State reports default to dry-run preview
- Destructive or write operations require `confirm_token` from a prior dry-run / preview step
- Not legal advice; operators remain responsible for filings

## Install — Cursor

Add to Cursor MCP settings (JSON):

```json
{
  "mcpServers": {
    "treatlog": {
      "url": "https://treatlog.com/api/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_ORG_MCP_API_KEY"
      }
    }
  }
}
```

Replace the bearer token with your org key from TreatLog settings after signup.

## Install — Claude Desktop

`claude_desktop_config.json`:

```json
{
  "mcpServers": {
    "treatlog": {
      "url": "https://treatlog.com/api/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_ORG_MCP_API_KEY"
      }
    }
  }
}
```

## Pricing for MCP

- **Field Free / demo org:** MCP **read-only** (`list_*`, `get_*`, `generate_state_usage_report` with `dry_run=true`). Mutating tools return `plan_upgrade_required` with `/pricing` and `/checkout?plan=treat_pro`.
- **TreatLog Pro ($29/mo):** MCP writes included (confirm-gated). Fair-use soft warning then hard daily cap on mutating calls (see `_mcp` metadata on tool results).
- Live Stripe checkout uses one price: `STRIPE_PRICE_ID` → TreatLog Pro. No separate MCP add-on.

Checkout: https://treatlog.com/checkout?plan=treat_pro · Pricing: https://treatlog.com/pricing.md

## Metering (honest)

- **MCP audit log:** each tool call writes a row to `mcp_audit_logs` (status, tool name, confirm token id when applicable) — operational trace, not a public usage dashboard.
- **State pack slots:** successful `generate_state_usage_report` runs (including `dry_run=true`) can consume a licensed state slot per org plan caps — same metering as the UI, not billing-only acquisition fiction.
- **No public MCP call counts** are published on treatlog.com; we do not invent traffic metrics.

## Agent index

Curated link list for LLM crawlers: https://treatlog.com/llms.txt

HTML: https://treatlog.com/mcp

Contact: TreatLog — support@treatlog.com · sales@treatlog.com