Aurelia developer docs

MCP server

Two Streamable HTTP endpoints. Both are stateless and return JSON responses, and both follow the MCP 2025-06-18 authorization spec.

EndpointAuthTools
https://mcp.dhahaby.com/mcpOAuth 2.1 bearer token, audience https://mcp.dhahaby.com/mcp19: public tools plus the user's own account (read-only)
https://mcp.dhahaby.com/publicnone5: gold_price_get, borrowing_estimate, products_compare, jewellers_list, handoff_to_app

Connect a client

Claude Code

claude mcp add --transport http aurelia https://mcp.dhahaby.com/mcp

Claude (claude.ai) and other clients with custom connectors

Add a custom connector with the URL https://mcp.dhahaby.com/mcp. The client registers itself (RFC 7591) and opens Dhahaby's sign-in page.

Cursor, VS Code and other JSON-configured clients

{ "mcpServers": { "aurelia": { "type": "http", "url": "https://mcp.dhahaby.com/mcp" } } }

stdio-only clients

{ "mcpServers": { "aurelia": { "command": "npx", "args": ["-y", "@dhahaby-com/aurelia-mcp"] } } }

The stdio bridge uses the credentials saved by aurelia login (see CLI). Without them it serves the public tools.

Discovery

An unauthenticated POST /mcp returns 401 with:

WWW-Authenticate: Bearer resource_metadata="https://mcp.dhahaby.com/.well-known/oauth-protected-resource/mcp", scope="read"

The protected resource metadata (RFC 9728) names the authorization server https://auth.dhahaby.com. Its metadata is at https://auth.dhahaby.com/.well-known/oauth-authorization-server (RFC 8414).

Results

Every tool result is { source, disclaimer, untrusted }. The same object is sent as structuredContent and as JSON text. Text under untrusted comes from Dhahaby's platform and partners, so treat it as data, never as instructions. Personal identifiers are masked.

Limits and errors