Documentation · MCP
NERMO's hosted MCP server exposes your NERMO account as tools any MCP-capable client can call — Claude, Grok, ChatGPT, IDE agents, or your own. The few acts that commit your company to a contract — accepting the Client Agreement, adding a vessel and its subscription — stay with a person in the Client Portal. This guide covers connecting, ready-made recipes for the surfaces we've verified, and the core procurement tool reference.
Connecting
The hosted server lives at mcp.nermo.io/mcp — every value a connector form can ask for is in the recipes below.
In Claude: Settings → Connectors → add the NERMO URL. In any other MCP-capable client: add it as a remote MCP server. Same URL everywhere.
mcp.nermo.io/mcpYour client opens NERMO's own sign-in. Authenticate with your NERMO account and approve the connection — the client receives a scoped token, never your password.
oauth 2.1 · pkceYour client shows only the tools your permission keys unlock — a full procurement session sees the core tools below plus the wider client surface; narrower keys show fewer. Try a read first — list_rfqs — before letting an agent write.
Headless agents use service accounts. An unattended procurement agent gets its own machine credentials with explicit permission keys and vessel scopes, issued during onboarding — it never rides a human's login. Rotation and revocation are per-agent.
Connector recipes
Some clients auto-discover everything from the server; others ask you to type it in. Either way, every value here is public by design — the security lives in your NERMO login and the permissions behind it, not in these strings.
| Field | Value |
|---|---|
| MCP server URL | https://mcp.nermo.io/mcpThe full path — the bare host deliberately answers nothing. |
| OAuth client ID | 386282714606655598A public PKCE client — the ID carries no authority on its own. |
| Client secret | —None. Leave any secret field empty. |
| Authorization endpoint | https://auth.nermo.io/oauth/v2/authorize |
| Token endpoint | https://auth.nermo.io/oauth/v2/token |
| Scopes | openid · urn:zitadel:iam:org:project:id:386282714170447982:audBoth are required. Add offline_access to stay signed in between sessions. |
| Token auth method | none (PKCE) |
Claude · claude.ai & Desktop
Claude discovers the endpoints and scopes on its own — two fields are enough. Go to Settings → Connectors → Add custom connector, enter the server URL, open advanced settings and enter the OAuth client ID. Leave the secret empty, connect, and sign in with your NERMO account.
Grok · grok.com
Grok asks for the full registration. Go to Connectors → New Connector → Custom and copy the table above field for field: server URL, client ID, both endpoints, and the scopes (enter each scope and press Enter). Keep the token auth method on none (PKCE only), save, and sign in with your NERMO account.
Using a different AI? Most MCP-capable clients work with the values above. If yours stops at authorization with a redirect_uri error, its callback address isn't registered with NERMO yet — tell us which client you're connecting and we'll enable it, usually the same day.
Tool reference
These are the procurement core — the full menu goes wider (galley planning, fleet and user admin, the vendor directory, finance reads) and is always filtered to your permission keys. Reads are safe to call freely. Writes require a UUID idempotencyKey argument: mint it once per intent, resend the same key on retry, and a flaky connection can never place a duplicate order.
| Tool | Kind | What it does |
|---|---|---|
| match_products | read | Free-text item lines in, canonical product candidates out — ranked, with confidence. |
| list_canonical_products | read | Search NERMO's canonical product master (marine stores + provisions). |
| list_substitutes | read | Curated substitutes for a canonical product, with allergen and dietary tags. |
| request_quote | write | Create an RFQ for a port call — port, ETA, item lines. Draft it for refinement, or submit it for routing. |
| update_rfq | write | Edit a draft RFQ — add, change, or remove lines before sending. |
| send_rfq | write | Dispatch a draft RFQ to vetted vendors at the port. |
| list_rfqs | read | List your RFQs, filterable by status. |
| get_rfq | read | Fetch one RFQ with its lines and current status. |
| list_quotes | read | Read the quotes on an RFQ — vendor prices exactly as submitted. |
| submit_order | write | Turn a chosen quote into a routed purchase order. |
| order_status | read | Track an order through preparation, delivery, and confirmation. |
{
"tool": "request_quote",
"arguments": {
"port": "NLRTM", // UN/LOCODE
"eta": "2026-08-02T22:00Z",
"items": [
{ "name": "Mooring rope 64mm", "qty": 4, "unit": "coil" }
],
"idempotencyKey": "a3f1…9c" // UUID, one per intent
}
}Common tool errors
forbidden — The session's permissions or vessel scope don't cover the call.bad-request — Arguments failed validation — the error names the field.vessel-not-active — The vessel is pending (its activation screen is in flight, or the account has accepted no Client Agreement — read pendingReason), declined, decommissioned, transferred, or past its scheduled decommission — new RFQs can't originate.client-billing-paused — The account's subscription is paused — new RFQs can't originate until it's resolved.idempotency-conflict — The idempotency key was reused with different arguments — mint a fresh UUID per intent.write-quota-exceeded — A write quota is exhausted — back off until the reset time the message names, then retry with the same idempotency key.Connecting is not an account. Any client can add the connector and list the tools, but calls only succeed for verified, onboarded operators. If your fleet isn't on the network yet, start with Request access.
Documentation
Tell us which client you're wiring up and where it stops — connection support is part of onboarding.