Make the connection.

A working MCP sandbox, documented limits, and a straightforward path from first request to mock order.

Mock only. The default catalog lists only operator-published supplier entries and is currently empty. Mock fixtures are available only when requested. Prices, stock and real purchasing are not available; all transaction flows remain mock. No live supplier is connected. Never send real payment tokens, card details or customer delivery information.

For an agent

1. Read llms.txt and capability status JSON before using Aisle.
2. Confirm that this is the sandbox and that live_purchases is false. Catalog-only results are informational, and mock fixtures are test data. Neither is available for real purchase.
3. Use the operator-provided scoped credential to initialize MCP and list tools. If no credential was supplied, stop at reading these docs. Do not invent one or claim a successful connection.
4. For any mock order, follow the separate human approval flow below. A returned mock order does not represent a purchase.

For a developer

1. Obtain sandbox access

The Aisle operator provisions scoped bearer credentials manually. Public signup, token issuance and a public access-request contact are not yet available. If you are collaborating directly with the operator, ask for a sandbox agent credential through their secure channel. Keep the separate approver credential out of the agent client.

2. Configure your MCP client

Use a remote Streamable HTTP client with custom bearer-header support. The endpoint is https://agent-store-sandbox.agent-store-2ba49950.workers.dev/mcp. This is not an SSE GET endpoint. The generic client configuration below requires you to replace the token placeholder; consult your client’s documentation for its actual settings.

{
  "mcpServers": {
    "aisle": {
      "url": "https://agent-store-sandbox.agent-store-2ba49950.workers.dev/mcp",
      "headers": {
        "Authorization": "Bearer <YOUR_SANDBOX_AGENT_TOKEN>"
      }
    }
  }
}

3. Initialize and list tools

Set AISLE_SANDBOX_TOKEN privately in your shell environment. These commands use the actual deployed API, with no fixture credentials embedded.

curl 'https://agent-store-sandbox.agent-store-2ba49950.workers.dev/mcp' \
  -H "Authorization: Bearer $AISLE_SANDBOX_TOKEN" \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  --data '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"your-agent","version":"1.0.0"}}}'

Expected initialization fields: protocolVersion: "2025-06-18", server name agent-store-sandbox, and instructions stating that all transactions are mock. Then send notifications/initialized (no id; returns 202) and list the tools:

curl 'https://agent-store-sandbox.agent-store-2ba49950.workers.dev/mcp' \
  -H "Authorization: Bearer $AISLE_SANDBOX_TOKEN" \
  -H 'Content-Type: application/json' \
  --data '{"jsonrpc":"2.0","id":2,"method":"tools/list"}'

Eight implemented tools

• catalog — browse published supplier entries with pagination. Empty until a licensed feed is reviewed and published. Mock fixtures are excluded unless include_mock: true is requested. Catalog-only entries have unverified stock and no price.
• suppliers — connection states, not a list of approved live partners.
• search — exact product ID, GTIN, or brand and model; optional variant and pack filters.
• quote — product ID, quantity and test destination; creates an expiring mock quote.
• buy — approved quote, separate authorization ID and fixed mock payment token; creates a mock order.
• track — simulated fulfillment status for an owned mock order.
• cancel — cancel an eligible mock order.
• return — request a mock return; no refund or RMA approval is issued.

Use tools/list for authoritative input schemas. MCP write tools require idempotency_key in arguments (8–128 characters). REST writes require an Idempotency-Key header. Reusing a key with a different action or payload returns a conflict.

Human approval stays separate

1. Search for a specific sandbox fixture, then call quote with product_id, quantity and destination: {country: "US", postal_code: "90210"}.
2. A separate human-held approver credential calls POST /v1/authorizations with {quote_id, max_total, approved: true}. Amounts are USD integer cents. The agent credential cannot authorize.
3. The agent calls buy with that quote_id, authorization_id, payment_token: "mock_payment_authorized" and a unique idempotency_key.
4. Quotes expire after 120 seconds and can be purchased once. If the quote changes, expires or exceeds the approved budget, obtain a new quote and approval.

REST & discovery

• Deployed OpenAPI 3.1 document — REST paths and request schemas.
• Public API health — mode and live-purchase flag.
• Sandbox service discovery — Aisle’s custom service metadata.
• Protocol guide — PAP registration, issuer constraints and preview limits.

Common connection outcomes

401: missing or invalid credential. 403: insufficient scope, invalid Origin or an agent attempting approval. An authenticated GET /mcp returns 405; use POST. 409: expired/consumed quote or idempotency conflict. 422: a business rule rejected the request. MCP tool errors may be returned inside a 200 response with isError: true; inspect the JSON body.

The API currently rejects an Origin header that differs from its own origin. Use a server-side MCP client. Direct cross-origin browser calls are not enabled. The landing page does not accept credentials or proxy private requests.