MCP Column

MCP Column Overview

This guide is the Superroute MCP column in Developer Center. It covers both servers, agent security, and the live tool catalog from UserMcpToolCatalog.

• User MCP — manage orders, routes, labels, digests for ops/support agents — https://api.miliexpress.com/mcp
• Developer MCP — guides, webhooks, sample shipping/route APIs for integrators — https://api.miliexpress.com/mcp/developer
• Security: connection Bearer, X-MCP-Profile / scopes, confirm for high-risk tools
• Human approval queue (propose_write + /mcp-approvals UI)

What is MCP?

The Model Context Protocol (MCP) is an open standard that allows AI assistants like Claude, Cursor, and ChatGPT to interact with external tools and services. It enables your AI to perform real actions — such as tracking a package — directly within the conversation.

By configuring the Superroute MCP server, your AI assistant gains access to logistics tools without leaving your workflow.

Two MCP Servers

Use the right server for the audience. Do not give unattended agents the Developer server with a full-access token.

Quick Start

Public tools like package tracking work without any authentication. Add this configuration to your MCP client:

{
  "mcpServers": {
    "mili-express": {
      "type": "url",
      "url": "https://api.miliexpress.com/mcp"
    }
  }
}

Authenticated Access

To use tools that require user permissions, add your API Bearer token to the configuration:

Always put tokens in MCP connection headers — never in tool arguments or prompts.

{
  "mcpServers": {
    "mili-express": {
      "type": "url",
      "url": "https://api.miliexpress.com/mcp",
      "headers": {
        "Authorization": "Bearer <your-api-token>",
        "X-MCP-Profile": "ops-readonly"
      }
    }
  }
}

How to Get an API Token

Call the login endpoint with your credentials:

curl -X POST https://api.miliexpress.com/api/v1/user/login \
  -H "Content-Type: application/json" \
  -d '{"email": "you@example.com", "password": "your-password"}'

The response will include your access token:

{
  "access_token": "eyJ0eXAiOiJKV1Qi...",
  "token_type": "Bearer",
  "expires_at": "2026-02-20 00:00:00"
}

Use the access_token value in the Authorization header of your MCP configuration.

Agent Security Model

User MCP is built for least-privilege agents. Create tokens with an MCP profile (default Ops Read-only) or pass profile/scopes headers.

Profiles (X-MCP-Profile)

Named scope bundles. Prefer ops-readonly or support for unattended agents.

{
  "mcpServers": {
    "mili-express": {
      "type": "url",
      "url": "https://api.miliexpress.com/mcp",
      "headers": {
        "Authorization": "Bearer <ops-readonly-token>",
        "X-MCP-Profile": "ops-readonly"
      }
    }
  }
}

Optional headers

High-risk confirm

These tools require confirm=true on tools/call (or use the approval queue):

• cancel_order
• bulk_create_orders
• reroute_to_address
• build_route
• hold_order
• release_order
• approve_pending_write
• bulk_create_orders_async
• get_shipping_detail
• download_shipping_label
• cancel_shipping_label
• submit_shipping_information
• end_of_day
• uniorder_cancel
• uniorder_purchase_label
• uniorder_create_batch
• uniorder_create_batch_async
• pay_shipping_order
• cancel_shipping_order
• pay_storage_order
• cancel_storage_order
• pay_shipout
• cancel_shipout

Human approval queue

Unattended agents should propose writes; humans approve in the app or via MCP.

1. Agent: propose_write or send X-MCP-Require-Approval: 1
2. Human: open MCP Approvals in the web app, or list_pending_approvals
3. Human: approve_pending_write with confirm=true, or reject_pending_write

Web UI path (login required): /mcp-approvals

Developer MCP authentication

Prefer Authorization: Bearer on the connection. Per-tool api_token is deprecated and hard-cuts after 2026-12-31.

Available Tools

The following tools are currently available on the MCP server: 93 live tools from the server catalog

This table is generated from UserMcpToolCatalog at request time — it stays in sync with production tools/list for authenticated full access.

Client-Specific Setup

Select your AI client below for tailored setup instructions:

{
  "mcpServers": {
    "mili-express": {
      "type": "url",
      "url": "https://api.miliexpress.com/mcp"
    }
  }
}

{
  "mcpServers": {
    "mili-express": {
      "type": "url",
      "url": "https://api.miliexpress.com/mcp",
      "headers": {
        "Authorization": "Bearer <your-api-token>",
        "X-MCP-Profile": "ops-readonly"
      }
    }
  }
}

{
  "mcpServers": {
    "mili-express": {
      "type": "url",
      "url": "https://api.miliexpress.com/mcp"
    }
  }
}

{
  "mcpServers": {
    "mili-express": {
      "serverUrl": "https://api.miliexpress.com/mcp"
    }
  }
}

Technical Details

• Protocol: JSON-RPC 2.0
• Transport: HTTP POST (Streamable HTTP)
• Rate Limit: 60 requests per minute
• Content-Type: application/json
• Endpoint: https://api.miliexpress.com/mcp
• Protocol revisions: 2026-07-28, 2025-11-25, 2025-06-18, 2025-03-26, 2024-11-05
  Both protocol eras are served on the same endpoint: clients that open with an initialize handshake, and stateless clients that declare the revision on every request. No session id is ever issued.
• OAuth discovery: https://api.miliexpress.com/.well-known/oauth-protected-resource
  An unauthenticated request answers 401 with a WWW-Authenticate header pointing at the protected-resource metadata document.