Quickstart

Two public documents, no key and no account. The first lists every server, its endpoint and its tools and says which are publicly available; the second is the only price that counts, per product and per tool, with the free allowance and the rules for what is charged.

curl -sS https://jithox.com/api/capabilities/v1

curl -sS https://jithox.com/api/pricing/v1

If you are an agent rather than a person, the agent context names every canonical document and what each is authoritative for, and SKILL.md is the same onboarding as an instruction file you can load.

Sign up, verify your e-mail, then create an MCP credential from your dashboard. The credential is shown once — copy it immediately. If you lose it, rotate it; you never have to pay twice and your balance is untouched by a rotation.

One key per server, created on that server’s connect page and shown once:

• Jithox E-Invoice
• EU Import Preflight
• EU Energy Label Preflight
• EU Counterparty Sanctions Preflight

Each product is its own MCP server with its own OAuth resource, so a token minted for one is refused by another. That is deliberate: a credential cannot spend somewhere you did not intend.

Authentication is OAuth 2.1 with PKCE (S256, mandatory). Your client discovers the authorization server from /.well-known/oauth-protected-resource and registers itself — you paste your access key once on the consent screen, and the client keeps a refreshing connection. Discovery below needs none of that; a paid tool call does.

Discovery is open on every server: initialize and tools/listneed no token and cost nothing. These two commands run in a bare terminal exactly as written — swap the URL for another product’s endpoint from the table above to explore it instead.

curl -sS https://mcp.jithox.com/mcp \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"quickstart","version":"1"}}}'

curl -sS https://mcp.jithox.com/mcp \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/list","params":{}}'

initializereturns the server’s name and protocol version; tools/list returns the tools and their input schemas. Both answer with plain JSON — there is no session header to carry between requests.

A tool call spends a free call or balance, so it needs your key. An MCP client exchanges it for an OAuth token on the consent screen; a terminal sends the key itself as a bearer token and needs no browser. Every client needs the same thing — the endpoint. In VS Code that is .vscode/mcp.json:

{
  "servers": {
    "jithox-einvoice": {
      "type": "http",
      "url": "https://mcp.jithox.com/mcp"
    }
  }
}

Claude Desktop has no file for remote servers — open Settings → Connectors → Add custom connector and paste the same URL. Whatever the client, it discovers the authorization server, registers itself, and opens a consent screen where you paste your access key once. The connect page has the exact steps for VS Code, Cursor, Claude Desktop and any generic client.

A structural VAT check is the fastest way to see the whole path — decision, evidence and a signed receipt. Ask your client to run validate_vat_number on BE0403170701. From a terminal it is one JSON-RPC request carrying your key as a bearer token. In Bash or Zsh the key is read into $JITHOX_ACCESS_KEY silently, so it never lands in shell history:

# Bash/Zsh (read -rs is not POSIX sh). Paste the key when prompted; it is read silently and never lands in shell history.
read -rs JITHOX_ACCESS_KEY && export JITHOX_ACCESS_KEY

curl -sS https://mcp.jithox.com/mcp \
  -H "Authorization: Bearer $JITHOX_ACCESS_KEY" \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"validate_vat_number","arguments":{"vatNumber":"BE0403170701"}}}'

# Clear the key from this shell when you are done:
unset JITHOX_ACCESS_KEY

The result carries a machine-readable decision state, the evidence behind it, and a _meta.receiptyou can verify offline against the server’s published public key. Without a key this exact call returns 401 and runs nothing; a key this server does not accept is refused as invalid_api_key. Neither is ever charged.

Prices are server-side and per accepted call. Your client never sends an amount, and nothing a client says can change a price.

Every row here is read from the running price catalog at request time, so the products shown are exactly the ones on sale right now. If an official source is down, that product’s calls return a truthful unavailable and cost €0,00 — the price is what a call costs, not a promise the source is up this second.

The server answers 402 payment_required with a typed payment_required object on the error: the product and tool, why (budget_exhausted or entitlement_required), the amount required in cents, your remaining free calls, and the pricing and checkout URLs to act on. chargeable is always false: it does not execute, does not charge, and does not upgrade you to anything. Add prepaid credit and repeat the same call.

• —One balance covers every product — spend it wherever you like.
• —Credit does not expire and there is no automatic top-up.
• —Tax is charged on top of credit and is never spendable.
• —A refund reverses credit; it never creates a negative balance.

Every accepted call answers with _meta.receipt: an Ed25519 signature over what was asked, what was answered and when. The public key is published separately from the receipt, so verifying one is a local computation — the receipt verification guide walks through it with the exact commands.

# The key that signs this server's receipts (every server publishes its own):
curl -sS https://mcp.jithox.com/receipts/public-key.pem

Your calls and every receipt they produced are also listed on your usage page.