Dudley Catalog Prep: MCP server
Catalog Prep turns messy corrugated carton supplier files into clean, reviewed import files for your store's template. It also lists every field it could not fill in with confidence. Your assistant connects to it over MCP.
Nothing publishes without human review. Catalog Prep only prepares files. It never sends anything to a store, and it never makes up a value it cannot find in your files, such as a price, a SKU, a hazmat flag, or a certification. Those fields stay in the unresolved list for a person to fill in. Deleting a job needs the account owner's approval in their own browser.
Status: prototype, synthetic evidence only (prototype_synthetic).
Connect
| Item | Value |
|---|---|
| Endpoint | https://mcp.dudleyapps.com/mcp |
| Transport | Streamable HTTP, stateless. POST returns plain JSON (application/json); clients that also accept text/event-stream still get JSON. |
| Protocol versions | 2024-11-05, 2025-03-26, 2025-06-18, 2025-11-25 (negotiated at initialize) |
| Sessions | Stateless: the server does not issue an Mcp-Session-Id, and it accepts and ignores one a client sends. |
| Resource metadata | /.well-known/oauth-protected-resource/mcp |
Sign-in options
- OAuth with PKCE and automatic registration (recommended). The client finds the authorization server from the resource metadata, registers itself (Dynamic Client Registration), and signs the person in with authorization code + PKCE. Anyone can sign up. A new account gets its own private sandbox on first use: sample data only, 10 jobs over 30 days (2 at a time).
- Pre-registered OAuth client. For hosts that cannot register themselves, the operator issues a client ID; the sign-in flow is the same.
- Reviewer key (directory review only). A bearer key the operator issues for one test account. It can only read (
catalog:read), it can be revoked at any time, and it cannot upload, prepare, cancel, or delete.
Scopes are narrow and separate: catalog:read (read status and results), catalog:write (upload files, prepare, cancel), and catalog:delete (request a deletion, which the person still has to approve).
A person can disconnect every assistant at once from /v1/deletion-approvals/disconnect. Existing tokens stop working, and an assistant can reconnect only after the person signs in again.
Tools
Every tool answers with a plain-text sentence first. The typed result follows as structuredContent (and repeated as JSON text at the end of content).
| Tool | Access | readOnlyHint | destructiveHint | idempotentHint | Scope |
|---|---|---|---|---|---|
get_catalog_profile | read | true | false | true | catalog:read |
upload_catalog_file | write | false | false | true | catalog:write |
prepare_catalog | write | false | false | true | catalog:write |
get_catalog_job | read | true | false | true | catalog:read |
list_catalog_artifacts | read | true | false | true | catalog:read |
read_catalog_artifact | read | true | false | true | catalog:read |
cancel_catalog_job | write | false | true | true | catalog:write |
delete_catalog_job | write | false | true | true | catalog:delete |
openWorldHint is false for every tool: none of them reach outside Catalog Prep.
get_catalog_profile
- In: nothing.
- Out:
id, a stable opaque profile ID (a keyed hash; never an email or the identity-provider subject).
upload_catalog_file
- In:
role(supplierortemplate),filename,content_type(text/csvor.xlsx),content_encoding(utf8orbase64),content,evidence_class,request_key(16 to 128 characters), optionalsha256. - Out:
upload_id,role,filename,content_type,byte_length,sha256,status(sealed),replayed. - Repeating the same
request_keywith the same file returns the first upload.
prepare_catalog
- In:
supplier_upload_id,template_upload_id,evidence_class,request_key. - Out: a job:
job_id,state,revision,progress_class,terminal_code,result_available,next_poll_at, retention and version fields.
get_catalog_job
- In:
job_id. - Out: the same job fields. Poll at
next_poll_atuntil the job is terminal.
list_catalog_artifacts
- In:
job_id. - Out:
artifacts(each withartifact_id,kind,media_type,byte_length,sha256),counts,manifest_digest,retention_deadline. - A finished job has four artifacts:
importable.csv,unresolved.json,summary.json, andmanifest.json.
read_catalog_artifact
- In:
job_id,artifact_id. - Out: a text summary, then the artifact as UTF-8 text inside an embedded resource (
dudley-catalog://jobs/<job>/artifacts/<artifact>), then its metadata (kind,media_type,byte_length,sha256,retention_deadline). The SHA-256 of the text matches the listedsha256.
cancel_catalog_job
- In:
job_id,request_key. - Out: the job. Stops pending work; a result that already finished is kept.
delete_catalog_job
- In:
job_id. - Out:
statusand a deletion receipt. The first call returnsapproval_requiredwith anapproval_url. The assistant gives that link to the person and stops; it must not open it. The person signs in with a passkey and approves, or declines ("Don't delete"), which deletes nothing. After an approval the assistant calls the tool again to carry out the deletion. Deletion removes the inputs, processing attempts, and artifacts; a receipt without file contents remains.
Limits
| Limit | Value |
|---|---|
| Inline file size | 4,000,000 decoded bytes per upload or artifact read |
| Rows per file | 5,000 |
| Request rate | 100 requests per minute per person, per action |
| Retention | A finished job's files are kept for 7 days unless deleted sooner |
| Errors | JSON with a stable code, a message, and retryable; rate_limited adds retry_after_seconds |
Example prompts
Each needs the supplier file and the store's import template (a CSV with the store's column headers).
- "Turn this supplier price list into a CSV I can import into my store."
- "Clean up this carton spreadsheet: sizes, board grade, and case pack in separate columns."
- "Which rows in my supplier file are missing dimensions or pricing?"
- "Convert this corrugated box catalog into my ecommerce import format and show me what you couldn't match."
Data handling
- Files are processed by a fixed rule pack, not by a language model.
- No payments, no third-party sharing, and no store connections.
- Product page: dudleyapps.com/connectors/catalog-prep.
- Privacy policy: dudleyapps.com/privacy/catalog-prep.
- Terms of service: dudleyapps.com/terms/catalog-prep.