For AI agents
409A.io MCP server
A Model Context Protocol server that lets a founder's AI agent order a 409A valuation, upload the company's documents, and check status. No human is needed except to pay.
Endpoint
Streamable HTTP. Discovery document at https://www.409a.io/.well-known/mcp.json.
https://www.409a.io/api/mcpTools
| Tool | API key | What it does |
|---|---|---|
| get_document_list | No | Returns the Document Request List with the required items flagged. |
| start_engagement | No | Creates the engagement and returns a Stripe Checkout link for a human to pay. |
| upload_document | Yes | Uploads a small file (up to 3 MB, base64) to a paid engagement and reports what is still missing. |
| get_upload_url | Yes | Mints a 15-minute direct upload URL for files up to 25 MB. The file goes straight to storage. |
| confirm_upload | Yes | Confirms a direct upload was recorded and reports what is still missing. |
| get_status | Yes | Returns status, documents received and missing, and the report URL once delivered. |
| rotate_key | Yes | Issues a new API key and invalidates the current one immediately. |
How an order works
- The agent calls
get_document_listandstart_engagement. Neither needs a key. - A human pays.
start_engagementreturns a Stripe Checkout link. The agent hands it to the founder. Payment is completed by a person through Stripe; the server never accepts card details. - When Stripe confirms payment, 409A.io emails an API key (prefix
409a_live_) to the contact address. - The agent uses the key for
upload_documentandget_statusuntil the report is delivered.
Documents
Always required: cap_table, articles_of_incorporation, financials.
safe_note_ledger is required if the company has any outstanding SAFEs or convertible notes.
PDF, XLSX, CSV, and DOCX, up to 25 MB per file. The full list with descriptions comes from get_document_list.
Large files
upload_document carries the file inline and is limited to 3 MB. For anything bigger, call get_upload_url, PUT the raw bytes to the returned URL with the returned headers, then call confirm_upload. Storage reports completion to 409A.io directly, so the upload counts only once it is confirmed.
Authentication
One key per engagement, sent as a bearer token. The header is the preferred method. Clients that cannot set headers may append the key to the endpoint URL as ?key=409a_live_... instead; treat that URL as a secret. If a key is exposed, call rotate_key with the current key: the old key stops working immediately and the new one is emailed to the contact.
Authorization: Bearer 409a_live_...Connect
Claude
Claude Desktop or claude.ai: Settings → Connectors → Add custom connector, then paste the endpoint URL. Add ?key=409a_live_... to the URL once the key arrives. From Claude Code:
claude mcp add --transport http 409a https://www.409a.io/api/mcp \
--header "Authorization: Bearer 409a_live_..."ChatGPT
Settings → Connectors → Create (developer mode). Name it 409A.io, set the MCP server URL to the endpoint, authentication “No authentication” for ordering, or the endpoint with ?key=409a_live_... after payment.
Cursor
Add to ~/.cursor/mcp.json (or the project's .cursor/mcp.json):
{
"mcpServers": {
"409a": {
"url": "https://www.409a.io/api/mcp",
"headers": { "Authorization": "Bearer 409a_live_..." }
}
}
}Payment is always human. The server creates a Stripe Checkout link and stops. A person completes payment in Stripe under the standard terms. Agents cannot submit a card. Questions: henry@409a.io.