# Nous-approved MCP catalog entry.
# Presence in this directory = approval. Merged via PR review.
manifest_version: 1

name: klaviyo
description: 'Klaviyo marketing: campaigns, flows, segments, and reporting.'
source: https://developers.klaviyo.com/en/docs/klaviyo_mcp_server

# Official vendor-hosted remote MCP (URL-only — Hermes never spawns a local
# process for this entry). Native OAuth 2.1 + Dynamic Client Registration
# (verified live: RFC 9728 protected-resource metadata -> AS metadata with
# registration_endpoint); Hermes's MCP client + mcp_oauth_manager handle
# discovery, PKCE, token exchange, and refresh.

transport:
  type: http
  # Vendor-documented debloat params: core-tools-only trims the 262-tool
  # surface to ~40 core tools; disable-tools-with-user-generated-content
  # removes tools that read UGC (vendor's prompt-injection mitigation).
  # Drop the params in mcp_servers.klaviyo.url for the full surface.
  url: https://mcp.klaviyo.com/mcp?core-tools-only=true&disable-tools-with-user-generated-content=true

auth:
  type: oauth

# Composer-suggestion triggers (desktop brand pills).
suggest:
  keywords:
    - klaviyo
  hosts:
    - klaviyo.com

post_install: |
  On first connection Hermes opens a browser to authorize with
  Klaviyo (or run `hermes mcp login klaviyo`). Approve access,
  then restart the session so tools load.

  Requires an Owner/Admin/Manager Klaviyo role.

  Hermes pins the trimmed ~40-tool core surface plus Klaviyo's
  prompt-injection mitigation via URL params. For the full 262-tool
  surface, remove the query params from mcp_servers.klaviyo.url in
  config.yaml.