MCP Server

Convocados exposes a Model Context Protocol server so AI assistants can read and manage games on your behalf.

Endpoint

https://convocados.cabeda.dev/api/mcp

It serves both MCP eras from the same URL: theinitialize handshake (up to 2025-11-25) used by ChatGPT, and the stateless 2026-07-28 lifecycle (server/discover, no session).

Authentication

Anonymous: initialize, tools/list, and the read-only public tools work with no token —convocados_list_public_events andconvocados_get_game (a password-locked event returns{ "locked": true }).
OAuth 2.1: every other tool requires a Bearer token. The authorization server supports PKCE (S256) and dynamic client registration, so clients register themselves — there is nothing to configure by hand.

Metadata: /.well-known/oauth-protected-resourceand /.well-known/oauth-authorization-server. A 401 carries a WWW-Authenticate challenge pointing at the metadata.

Connect it to ChatGPT (developer mode)

Use ChatGPT on the web with a Plus, Pro, Business, Enterprise, or Education plan. Business/Edu admins may need to enable developer mode for the workspace first.
Open Settings → Security and login (older UI: Connectors → Advanced settings) and turn on Developer mode.
Go to ChatGPT Plugins, click the plus button, and create an app for a remote MCP server.
Name it Convocados, set the MCP server URL to https://convocados.cabeda.dev/api/mcp, and choose OAuth authentication.
Click Scan tools; complete the Convocados consent screen if prompted, then wait for the scan to finish and click Create.
In a chat, pick Developer mode from the plus menu and select the Convocados app.

Read-only tools work without signing in; connecting an account (OAuth) unlocks user-scoped reads and every write action.

Tools

Tool	Auth	Description
`convocados_list_public_events`	Anonymous	List public games looking for players
`convocados_get_game`	Anonymous	Event details by id (players, spots left)
`convocados_list_my_games`	OAuth	Your owned, admin, and followed games
`convocados_list_players`	OAuth	Roster for a game
`convocados_get_balance`	OAuth	Payment status and balances
`convocados_get_history`	OAuth	Recent games and scores
`convocados_get_ratings`	OAuth	ELO ratings
`convocados_add_player`	OAuth	Add a player to a game
`convocados_remove_player`	OAuth	Remove a player
`convocados_randomize_teams`	OAuth	Randomize or balance teams
`convocados_update_payment`	OAuth	Record a payment
`convocados_set_score`	OAuth	Save a game score
`convocados_create_event`	OAuth	Create a new event
`convocados_update_event`	OAuth	Change title, location, date/time, sport, capacity, visibility
`convocados_cancel_event`	OAuth	Cancel the current game
`convocados_rsvp`	OAuth	Set your own RSVP (yes / no / maybe)

Example

Handshake, then a tool call (JSON-RPC over POST):

{"jsonrpc":"2.0","id":1,"method":"initialize",
 "params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"ChatGPT","version":"1"}}}

{"jsonrpc":"2.0","id":2,"method":"tools/call",
 "params":{"name":"convocados_list_public_events","arguments":{"limit":5}}}

Writes are organizer-only

A token alone is not enough to mutate an event: write tools additionally verify you are the event owner or an admin (ADR 0022 / ADR 0035). Ownerless public events are read-only until adopted.