# Gateway product discovery over MCP

The connected Gateway discovery plugin uses OAuth at
`https://gateway-information-group.zappytap.chatgpt.site/mcp`.
Anonymous JSON discovery remains available at
`https://gatewayinformationgroup.com/api/catalog/v1/products`.

The website handler supports current MCP `2026-07-28` requests with the
existing required request metadata and mirrored method/name headers.
Its `server/discover` response describes that current protocol.

For clients using the earlier Streamable HTTP protocol, the website handler
also accepts `initialize` for `2025-11-25`, `2025-06-18`, or `2025-03-26`.
Send `protocolVersion`, `capabilities`, and `clientInfo` with a non-empty
client name and version. A supported requested version is returned unchanged;
another well-formed revision date negotiates `2025-11-25`. Disconnect if the
returned version is unsupported by your client. Malformed version input is
rejected without reflecting it in public errors. Send `notifications/initialized` after initialization,
then select that version explicitly with the `MCP-Protocol-Version` header
on subsequent POST requests. Include both `application/json` and
`text/event-stream` in `Accept`. The handler returns JSON and creates no
session. GET returns 405 because it offers no standalone SSE stream.

All versions expose the same eight discovery tools and argument checks.
March 2025 returns serialized JSON text. June and November 2025 also return
`structuredContent` and advertise output schemas. Current requests retain both
formats and the current result envelope. Unsupported post-initialization
versions and malformed or mixed protocol requests fail before product reads
or optional matching.

Current `server/discover` and `tools/list` complete results declare
`ttlMs: 300000` and `cacheScope: public` for their deterministic public
discovery metadata and definitions. HTTP responses remain `no-store`.
Runtime availability, product results, payment options, errors, initialization,
request metadata, credentials, and private sessions receive no cache lifetime.
Read product and payment availability again when reviewing a purchase.

Optional recommendation sends a non-sensitive task description to OpenAI only
when explicitly requested with `consent: true` and when matching is configured.
No discovery tool connects a wallet, creates an order or quote, signs, pays,
or authorizes spending. Use the existing purchase flow and approval controls.

*Protocol support in the website source does not prove that every hosted
connector, OAuth intermediary, SDK, or wallet accepts each version. The
separate optional-tip MCP endpoint has its own private capability and quote
contract; these instructions do not change it.*