For AI agents

409A.io MCP server

A Model Context Protocol server that lets a founder's AI agent order a 409A valuation, upload the company's documents, and check status. No human is needed except to pay.

Endpoint

Streamable HTTP. Discovery document at https://www.409a.io/.well-known/mcp.json.

https://www.409a.io/api/mcp

Tools

ToolAPI keyWhat it does
get_document_listNoReturns the Document Request List with the required items flagged.
start_engagementNoCreates the engagement and returns a Stripe Checkout link for a human to pay.
upload_documentYesUploads a small file (up to 3 MB, base64) to a paid engagement and reports what is still missing.
get_upload_urlYesMints a 15-minute direct upload URL for files up to 25 MB. The file goes straight to storage.
confirm_uploadYesConfirms a direct upload was recorded and reports what is still missing.
get_statusYesReturns status, documents received and missing, and the report URL once delivered.
rotate_keyYesIssues a new API key and invalidates the current one immediately.

How an order works

  1. The agent calls get_document_list and start_engagement. Neither needs a key.
  2. A human pays. start_engagement returns a Stripe Checkout link. The agent hands it to the founder. Payment is completed by a person through Stripe; the server never accepts card details.
  3. When Stripe confirms payment, 409A.io emails an API key (prefix 409a_live_) to the contact address.
  4. The agent uses the key for upload_document and get_status until the report is delivered.

Documents

Always required: cap_table, articles_of_incorporation, financials.

safe_note_ledger is required if the company has any outstanding SAFEs or convertible notes.

PDF, XLSX, CSV, and DOCX, up to 25 MB per file. The full list with descriptions comes from get_document_list.

Large files

upload_document carries the file inline and is limited to 3 MB. For anything bigger, call get_upload_url, PUT the raw bytes to the returned URL with the returned headers, then call confirm_upload. Storage reports completion to 409A.io directly, so the upload counts only once it is confirmed.

Authentication

One key per engagement, sent as a bearer token. The header is the preferred method. Clients that cannot set headers may append the key to the endpoint URL as ?key=409a_live_... instead; treat that URL as a secret. If a key is exposed, call rotate_key with the current key: the old key stops working immediately and the new one is emailed to the contact.

Authorization: Bearer 409a_live_...

Connect

Claude

Claude Desktop or claude.ai: Settings → Connectors → Add custom connector, then paste the endpoint URL. Add ?key=409a_live_... to the URL once the key arrives. From Claude Code:

claude mcp add --transport http 409a https://www.409a.io/api/mcp \
  --header "Authorization: Bearer 409a_live_..."

ChatGPT

Settings → Connectors → Create (developer mode). Name it 409A.io, set the MCP server URL to the endpoint, authentication “No authentication” for ordering, or the endpoint with ?key=409a_live_... after payment.

Cursor

Add to ~/.cursor/mcp.json (or the project's .cursor/mcp.json):

{
  "mcpServers": {
    "409a": {
      "url": "https://www.409a.io/api/mcp",
      "headers": { "Authorization": "Bearer 409a_live_..." }
    }
  }
}

Payment is always human. The server creates a Stripe Checkout link and stops. A person completes payment in Stripe under the standard terms. Agents cannot submit a card. Questions: henry@409a.io.