# Install the Postbye MCP server

> For AI agents: a plain-text index of this site is at https://postbye.com/llms.txt

The Postbye MCP server needs one URL and nothing else. Add it to Claude, Claude Code, Cursor, VS Code or ChatGPT in a minute, then ask your assistant how to cancel a subscription.

## Access

No account, API key or token is needed, so there is nothing to register or request. An optional OAuth sign-in exists for clients that insist on one (see below).

- Authentication: none needed. A request with no Authorization header is always served, and every sign-in field in a client can stay empty.
- Cost to use it: free. The server is public and read-only.
- Sessions: none. Each call is one stateless POST to /mcp, so any client can call it at any time.
- Request size: up to 64 KB per request.
- Protocol versions: 2026-07-28, 2025-11-25, 2025-06-18, 2025-03-26, 2024-11-05.

## Endpoint

One URL, the MCP Streamable HTTP transport, JSON responses:

```
https://postbye.com/mcp
```

The server keeps no sessions, so any client can call it at any time. A browser visit or a GET request returns a short description (HTTP 405) because /mcp only accepts POST. Cross-origin calls from web clients are allowed.

## Connect your assistant

Pick the client you use. All of them need only the endpoint above.

### Claude and Claude Desktop

On claude.ai, Claude Desktop or the mobile app, open Settings, then Connectors, and choose Add custom connector. Enter Postbye as the name and the endpoint as the URL, then save. Leave the sign-in fields empty.

```
https://postbye.com/mcp
```

### Claude Code

Run this once in your terminal:

```
claude mcp add --transport http postbye https://postbye.com/mcp
```

### Cursor

Add the server to .cursor/mcp.json in your project, or to ~/.cursor/mcp.json for every project:

```json
{
  "mcpServers": {
    "postbye": {
      "url": "https://postbye.com/mcp"
    }
  }
}
```

### VS Code

Add the server to .vscode/mcp.json in your workspace (GitHub Copilot agent mode reads it):

```json
{
  "servers": {
    "postbye": {
      "type": "http",
      "url": "https://postbye.com/mcp"
    }
  }
}
```

### ChatGPT (developer mode)

In ChatGPT, open Settings, then Connectors, then Advanced, and turn on Developer mode. Create a new connector, enter Postbye as the name and the endpoint as the MCP server URL, and set authentication to none.

```
https://postbye.com/mcp
```

## Transport and protocol

What a client or a script talks to:

- Transport: MCP Streamable HTTP, JSON responses. The server never opens an event stream, so there is nothing to keep alive.
- Methods: POST for every message. GET and DELETE return HTTP 405 with an Allow header and a short description that points back to /mcp-server; OPTIONS answers browser pre-flight checks.
- Cross-origin calls: allowed from any origin, because the server takes no credentials and reads no cookies.
- Protocol versions: 2026-07-28, 2025-11-25, 2025-06-18, 2025-03-26, 2024-11-05. A request for any other version gets HTTP 400 with the list of supported versions.
- Caching: responses are not cached (Cache-Control: no-store).

## Check the connection

To test the server without an assistant, send it a tools/list request from a terminal:

```bash
curl -s -X POST https://postbye.com/mcp \
  -H 'content-type: application/json' \
  -H 'accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
```

The answer is a JSON-RPC result listing search_companies, get_cancellation_guide, get_cancellation_letter, list_categories, each with its input schema.

## Optional sign-in with OAuth

Most clients need nothing. A client or directory that requires OAuth can take a free token that opens the same four read-only tools and nothing more.

- Discovery: https://postbye.com/.well-known/oauth-protected-resource names https://postbye.com/mcp as the protected resource, and https://postbye.com/.well-known/oauth-authorization-server describes the authorization server (RFC 9728 and RFC 8414).
- Grants: authorization_code with PKCE (S256 only), refresh_token and client_credentials. The only scope is mcp:read.
- Registration: dynamic client registration (RFC 7591) with a POST to https://postbye.com/api/oauth/register. Every registered client gets a client_id and a client_secret and may use all three grants, whatever grant_types it lists.
- Sign-in screen: none. Postbye has no accounts, so the authorization endpoint approves a valid request at once and returns the browser to the client with a code.
- Lifetimes: access tokens last 1 hour, refresh tokens 30 days, and a refresh chain ends after 90 days.
- Using a token: send Authorization: Bearer <access_token> with the POST to /mcp. A request with no token is still served. A request with an invalid or expired token gets HTTP 401 with error invalid_token and a WWW-Authenticate header that points at the protected-resource metadata.

### Step 1: register a client

Register once. The response carries client_id, client_secret and the three grants; keep the id and secret in your client's settings. Both client_secret_post and client_secret_basic work at the token endpoint:

```bash
curl -s -X POST https://postbye.com/api/oauth/register \
  -H 'content-type: application/json' \
  -d '{"client_name":"My agent","token_endpoint_auth_method":"client_secret_post"}'
```

### Step 2a: get a token with client credentials

For a script or a server-to-server connector, exchange the client credentials for an access token:

```bash
curl -s -X POST https://postbye.com/api/oauth/token \
  -d grant_type=client_credentials \
  -d client_id=<client_id> \
  -d client_secret=<client_secret> \
  -d scope=mcp:read
```

### Step 2b: get a token with authorization code and PKCE

For an app that signs a person in, register with redirect_uris, then send the browser to the authorization endpoint with a PKCE S256 challenge:

```
https://postbye.com/api/oauth/authorize?response_type=code&client_id=<client_id>&redirect_uri=<redirect_uri>&code_challenge=<S256 challenge>&code_challenge_method=S256&state=<state>
```

The browser returns to your redirect_uri with code, state and iss. Exchange the code at https://postbye.com/api/oauth/token with grant_type=authorization_code, the same redirect_uri and your code_verifier. The answer carries access_token, refresh_token and expires_in; exchange the refresh token with grant_type=refresh_token for a new pair.

### Step 3: call the server with the token

The call is the same as the anonymous one plus the header:

```bash
curl -s -X POST https://postbye.com/mcp \
  -H 'authorization: Bearer <access_token>' \
  -H 'content-type: application/json' \
  -H 'accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
```

## What the server does and does not do

The server is a lookup service for cancellation facts, nothing more:

- It reads: guides, notice periods, traps to check, mailing addresses and a letter text, all from the same data as the company pages on postbye.com.
- It does not buy, order, mail or change anything. Mailing a letter is a separate step on postbye.com.
- It stores nothing you type. A name or account number passed to get_cancellation_letter appears only in the letter text that comes back.
- It takes no account. The optional OAuth tokens are read-only, expire after an hour and open nothing the public endpoint does not.

## If something does not work

The usual causes, with what the server does in each case:

- A browser visit to https://postbye.com/mcp shows a short JSON description with HTTP 405. This is expected: the endpoint only accepts POST.
- The client asks you to sign in or to give an API key. Choose no authentication, or leave the fields empty: a call without a token is always served. If the client insists on OAuth, use the optional sign-in described above.
- The server answers HTTP 401 with error invalid_token. The request carried a Bearer token that is invalid or expired. Get a new token, or remove the Authorization header.
- The client only accepts a command to run. Use its remote or HTTP server option instead, and give it the endpoint URL above.
- The request fails with HTTP 413. A request may be at most 64 KB; send one JSON-RPC message per POST.
- The assistant says a company was not found. Ask it to run search_companies first and use the slug it returns.

## Keep reading

The other documentation pages for the server:

- [Postbye MCP Server for AI Assistants](https://postbye.com/mcp-server): Overview of the server: what it does, the endpoint and the four tools.
- [Postbye MCP Tools Reference](https://postbye.com/mcp-server/tools): Inputs, limits and results of the four tools.
- [Postbye MCP Examples](https://postbye.com/mcp-server/examples): Example prompts, tool calls with the server's real answers, and a curl request.
- [Postbye MCP Server FAQ](https://postbye.com/mcp-server/faq): Access, cost, data, limits and how the server relates to postbye.com.
- [Connect the Postbye MCP Server](https://postbye.com/mcp-server/clients): Steps and configuration for Claude, Cursor, VS Code, ChatGPT, the OpenAI API and other clients.

## Want the letter mailed for you?

Postbye prints the letter, sends it by certified mail and emails you the signed delivery proof.

[Find your company](https://postbye.com/cancel)