MCP Server

For the ChatGPT plugin with optional free account linking, see TrackOut in ChatGPT. The API-key setup below is for other agent clients.

The TrackOut MCP server lets AI agents access your garage data through the Model Context Protocol. No local install required -- just configure your agent with a URL and API key.

Setup

Prerequisites

• An API key from your TrackOut Settings page

Configure your agent

Add TrackOut to your agent's MCP configuration. For Claude Code, add to .claude/mcp.json:

{
  "mcpServers": {
    "trackout": {
      "type": "url",
      "url": "https://trackout.app/api/mcp",
      "headers": {
        "Authorization": "Bearer tok_..."
      }
    }
  }
}

Replace tok_... with your API key from Settings.

Available tools

Once connected, the following tools are available to your agent:

Cars

Parts

Service records

Installers

Track sessions

Maintenance

Tires

Checklists

Documents

Reading the tool schemas

Everything your agent needs to build a valid call is in the tool list itself, so it should not need this page open to get a first attempt right.

• Dates take YYYY-MM-DD -- 2024-01-15. A bare date is stored as a calendar day and reads the same in every timezone. An ISO 8601 timestamp is accepted too and keeps its time of day, but it must carry an explicit offset -- 2024-01-15T10:00:00Z or 2024-01-15T10:00:00-08:00. 2024-01-15T10:00 is rejected: without an offset it means local time to whichever machine parses it, so the same call would store two different instants. Nothing else parses.

• Units travel with the number. Lap times are seconds, fuel is US gallons, temperatures are °F, tread depth is millimetres (a US gauge reading of 8/32" is 6.3 mm), pressures are PSI, money is US dollars. Each numeric field publishes its minimum and maximum, so a value sent in the wrong unit usually fails immediately instead of being stored.
• Enumerated values are listed in the schema. serviceType carries the full set, so list_service_types is available but no longer a required first step. Maintenance rules offer only the types that can recur, and create_part offers only the statuses a part can be created in.
• null clears, omitting leaves alone. On an update tool, a field you leave out keeps its stored value. Fields whose description says so also accept null to erase the stored value -- that is how you remove a captured reading, an interval, or a linked shop.
• The high-value create tools carry a worked example in their description, with a realistic set of optional fields.

Protocol compatibility

TrackOut negotiates whichever of these Model Context Protocol versions your client asks for:

A client that sends no version is answered on 2025-03-26. Every version in this table is covered by a regression test that runs initialize, tools/list, and a tool call, so support here means exercised rather than merely accepted.

The server identifies itself as trackout and answers on a per-request stateless transport: it issues no mcp-session-id and keeps no session store.

Receipt workflow

The MCP receipt flow mirrors the TrackOut UI:

1. Call upload_document with a PDF or receipt image.
2. Call scan_receipt with the returned fileId to start extraction.
3. Wait for the extraction to finish, either way round:
   • Let the server wait. Pass wait: true and the call holds open for up to 25 seconds, returning the finished extraction as soon as it is ready. If it is still running when the wait ends, you get the same in-progress response as below -- call again with its receiptId.
   • Poll yourself. Call scan_receipt again with either the same fileId or the returned receiptId until the receipt is ready for review. fileId stays valid after the file is stored encrypted.
4. Create linked records with either:
   • create_service_record for a single record and pass receiptId
   • create_records_from_receipt for a multi-line-item receipt import

Give each record the cost the app would file it at: its labor line, plus the parts and consumables used in that job, plus its share of the receipt's tax and fees, split in proportion to each record's amount over all the lines you are importing. That is what Reports and the logbook add up, so a record costed at its labor line alone leaves the rest of the receipt out of your spend.

create_service_record accepts a receiptId. (The HTTP API and the local stdio server also accept receiptDocumentId as a compatibility alias.)

update_service_record deliberately does not. A record's provenance -- whether it came from a scan, an email, or the API -- is decided when the record is created and never revisited, so linking a receipt to a record that already exists is a different operation, not a field you can patch. That operation is available in the web app and is not on the API or MCP surface; attaching a receipt to a record that already has one has to decide what becomes of the old link, and that choice belongs in a screen where you can see both.

Streaming and progress

Tools that can take a while -- today that is scan_receipt with wait: true -- report progress while they run, so your agent can show "still scanning" instead of sitting silent.

This happens automatically: if your MCP client asks for progress on a call, TrackOut answers that call as a text/event-stream and sends progress updates on it until the result arrives. Clients that do not ask for progress get the same single JSON response they always have. Nothing to configure either way.

Two things worth knowing:

• Progress is scoped to the call that asked for it. TrackOut never opens a long-lived stream of its own, so there is no background connection to keep alive or reconnect.
• A wait: true call is bounded at 25 seconds. That is a ceiling, not a delay -- the call returns the moment extraction finishes.

Example usage

Once configured, you can ask your agent things like:

• "List my cars"
• "Show service records for my M3"
• "Log an oil change for my 911 at 42,000 miles, cost $85"
• "What tires are installed on my track car?"
• "Add a new installer called Track Performance Shop"
• "Create a new car named 'Track Beast' -- 2024 Porsche 911 GT3"
• "Add an oil filter part for my M3"
• "Set up a recurring oil change every 5,000 miles"
• "What's due on my M3?"
• "Upload this receipt, scan it, and show me the extracted line items"
• "Create linked service records from this scanned receipt for my M3"

The agent will use the appropriate MCP tools to read or write your TrackOut data.

HTTP API

The MCP server calls the TrackOut HTTP API under the hood. If you want to build your own integration, you can call these endpoints directly:

All endpoints require an Authorization: Bearer tok_... header. The base URL for direct API calls is https://site.trackout.app.

curl -H "Authorization: Bearer tok_..." \
  https://site.trackout.app/api/v1/cars

Error responses

All error responses are JSON shaped { "error": "<message>" } with an appropriate HTTP status code. The MCP route passes user-facing 4xx messages through unchanged; 5xx responses are mapped to a generic Upstream service temporarily unavailable. message on the MCP client so internal errors never leak through a tool call.

Upload limits

The upload_document tool (and POST /api/v1/documents/upload) enforces:

• Encoded request body: up to 14 MB
• Decoded file: up to 10 MB
• Allowed content types: application/pdf, image/jpeg, image/png, image/webp, image/heic, image/heif, image/gif, text/plain
• Uploads per minute: up to 60 per account, the same cap the web app uses. Past that, the tool returns Upload limit reached. Please try again later. until the minute rolls over.

Requests that exceed these limits fail fast with a 4xx before bytes are persisted.

Security notes

• Authorization is driven exclusively by your API token — the MCP session ID plays no role in authorization. Every request is independently authenticated.
• The MCP endpoint is intentionally per-request stateless: it issues no mcp-session-id at all, and keeps no server-side session store -- not even for streamed calls. There is no session key two users could collide on.
• API tokens are SHA-256 hashed at rest. Revoke a compromised token from the API keys page; revocation takes effect on the next request.
• Rotate tokens periodically and prefer creating one token per agent/tool so you can revoke narrowly.
• Uploaded documents are not served at a public URL. upload_document returns url: null; receipt images and part attachments are encrypted at rest and shown only through authenticated decrypt actions.
• Requesting Delete account in Settings immediately invalidates the API token. HTTP API calls then receive 401. MCP tools return an authentication error -- even while garage data is still being removed.