Integrations

VeriClaim can be used outside the app in two ways. The REST API is for your own code — catalogue pipelines, PIM systems, CI checks. The MCP server is for AI assistants, so a tool like Claude Code or Cursor can run a compliance check while you work. Both use the same API key, the same engine and the same credit balance, and everything they run appears in your scan history.

1. Create an API key

Organization admins create keys under Organization → API Keys. The secret (vc_…) is shown once — store it in your password manager or secret store straight away. A key is scoped to the organization that created it, and revoking it takes effect immediately.

Base URL for every REST call:

https://vericlaim.eu/api/public/v1

2. REST API

Send the key on every request as Authorization: Bearer vc_… or X-API-Key: vc_…. A minimal review looks like this:

curl -X POST https://vericlaim.eu/api/public/v1/reviews \
  -H "Authorization: Bearer vc_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{
    "texts": [{"id": "sku-123", "content": "Unser Detox-Tee stärkt das Immunsystem."}],
    "language": "de",
    "depth": "standard",
    "wait_seconds": 30
  }'

Full endpoint reference, depths, error codes and limits are on the API page.

3. MCP server

MCP (Model Context Protocol) is the standard way an AI assistant talks to an external tool. Ours is a remote server: there is nothing to install — you point your assistant at one URL and authenticate with your API key.

Server URL:

https://vericlaim.eu/mcp

Transport is stateless Streamable HTTP (protocol revision 2025-06-18), so every call is a single HTTPS request. Authenticate with the same key as the REST API: Authorization: Bearer vc_…, or X-API-Key: vc_… for clients that prefer a custom header.

Available tools

Tool	What it does
`submit_review`	Check product texts and return the findings — or a review ID to poll if the scan runs long.
`get_review_result`	Fetch the findings of a review by ID.
`list_languages`	List the languages your administrator has enabled.
`get_balance`	Report your organization's current credit balance.

Tools that scan consume credits exactly like a scan in the app, and the results appear in your scan history — an assistant cannot spend anything a person could not.

4. Connect your client

Claude Code

claude mcp add --transport http vericlaim \
  https://vericlaim.eu/mcp \
  --header "Authorization: Bearer vc_your_key_here"

Cursor — add to `mcp.json`

{
  "mcpServers": {
    "vericlaim": {
      "url": "https://vericlaim.eu/mcp",
      "headers": { "Authorization": "Bearer vc_your_key_here" }
    }
  }
}

VS Code — add to `.vscode/mcp.json`

{
  "servers": {
    "vericlaim": {
      "type": "http",
      "url": "https://vericlaim.eu/mcp",
      "headers": { "Authorization": "Bearer vc_your_key_here" }
    }
  }
}

Claude Desktop — via `mcp-remote`, which bridges the HTTP server to Desktop's local transport

{
  "mcpServers": {
    "vericlaim": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://vericlaim.eu/mcp",
               "--header", "Authorization: Bearer vc_your_key_here"]
    }
  }
}

Replace vc_your_key_here with your own key. The same configuration is shown, ready to copy, on the API Keys page inside the app.

Clients that expect a browser login

Some assistants add a connector by URL and then expect to log in through a browser window (OAuth). VeriClaim authenticates with an API key in a header instead, so those clients cannot connect yet — use one of the clients above, which all support header authentication. OAuth support is planned.

Troubleshooting

401 — the key is missing, mistyped, or has been revoked. The response names the accepted header formats; check the key still exists under Organization → API Keys.
402 — not enough credits. The body reports your balance and what the call required; top up under Billing & Credits.
429 — rate limited. Reviews are limited to 30 submissions per minute and 120 polls per minute per key.
405 on GET or DELETE of the MCP endpoint is expected: the server is stateless, so it has no session to stream or tear down.