FXMapServer URL
https://fxmap.app/api/mcpJSON-RPC 2.0 over HTTP POST. Most MCP clients only need the URL — they discover everything else from the OAuth metadata documents below.
Discovery Endpoints
| Endpoint | Spec | Purpose |
|---|---|---|
| /.well-known/oauth-protected-resource | RFC 9728 | Tells clients which authorization server protects /api/mcp. |
| /.well-known/oauth-authorization-server | RFC 8414 | Lists registration, authorize, token, and revoke endpoints. |
| /api/oauth/register | RFC 7591 | Dynamic Client Registration. POST client metadata, get client_id back. |
| /api/oauth/authorize | OAuth 2.1 | Authorization endpoint. Auto-approves (read-only public data) and returns a code via redirect. |
| /api/oauth/token | OAuth 2.1 + PKCE | Exchanges the code (and PKCE verifier) for a 1-hour bearer token. |
| /api/oauth/revoke | RFC 7009 | Revokes an access token early. |
Manual OAuth Flow (for testing)
MCP clients run this automatically. To exercise it by hand:
# 1. Register a client (RFC 7591)
curl -X POST https://fxmap.app/api/oauth/register \
-H "Content-Type: application/json" \
-d '{
"client_name": "my-mcp-client",
"redirect_uris": ["http://localhost:8080/callback"],
"token_endpoint_auth_method": "none",
"grant_types": ["authorization_code"],
"response_types": ["code"]
}'
# → { "client_id": "...", ... }
# 2. Build a PKCE pair
VERIFIER=$(openssl rand -base64 64 | tr -d '=+/' | cut -c1-64)
CHALLENGE=$(printf '%s' "$VERIFIER" | openssl dgst -sha256 -binary \
| openssl base64 | tr -d '=' | tr '/+' '_-')
# 3. Hit /authorize — the response is a 302 redirect with ?code=...
curl -i "https://fxmap.app/api/oauth/authorize?response_type=code\
&client_id=$CLIENT_ID\
&redirect_uri=http://localhost:8080/callback\
&code_challenge=$CHALLENGE&code_challenge_method=S256\
&state=xyz"
# 4. Exchange code → access token
curl -X POST https://fxmap.app/api/oauth/token \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "grant_type=authorization_code&code=$CODE\
&redirect_uri=http://localhost:8080/callback\
&client_id=$CLIENT_ID&code_verifier=$VERIFIER"
# → { "access_token": "...", "token_type": "Bearer", "expires_in": 3600 }
# 5. Call the MCP server
curl -X POST https://fxmap.app/api/mcp \
-H "Authorization: Bearer $ACCESS_TOKEN" \
-H "Content-Type: application/json" \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'Claude Desktop / Code Config
Add this to your client's MCP server config — DCR handles the rest.
{
"mcpServers": {
"fxmap": {
"url": "https://fxmap.app/api/mcp",
"transport": "http"
}
}
}Available Tools
get_exchange_ratesLatest fiat exchange rates (~161 currencies) for a base currency.
{ "base": "USD" }convert_currencyConvert an amount between two currencies at the latest rate.
{ "from": "USD", "to": "EUR", "amount": 100 }get_historical_ratesUp to 30 days of daily history for a currency pair.
{ "base": "USD", "target": "JPY", "days": 30 }get_top_moversTop gainers and losers vs a base over a time window.
{ "base": "USD", "days": 7, "limit": 5 }get_rate_changesPercentage changes for all currencies. Set multi=true for 1d/7d/30d.
{ "base": "USD", "multi": true }get_crypto_pricesCurrent cryptocurrency prices in any fiat currency.
{ "vs": "usd" }get_metal_pricesGold, Silver, Platinum, Palladium per troy ounce.
{ "vs": "USD" }get_oil_pricesWTI and Brent crude oil prices per barrel (USD).
{}get_bigmac_indexBig Mac Index entries for purchasing-power comparison.
{}Rate Limits
| Endpoint | Limit | Notes |
|---|---|---|
| /api/mcp | 120 req/min | Per IP. JSON-RPC calls. |
| /api/oauth/register | 5 req/min | DCR — strictest. |
| /api/oauth/* | 30 req/min | Authorize, token, revoke. |
| /api/* (other) | 60 req/min | REST endpoints. |
Every API response carries X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset headers. Exceeding the limit returns 429 with Retry-After.
Prefer plain REST?
The same data is available without OAuth via the REST API.