MCP Server — Connect AI Assistants to DPP Data

The TracePass MCP server lets an AI assistant drive the TracePass platform directly — list and create products, build and audit Digital Product Passports, set economic-operator parties, and read or capture GS1 EPCIS supply-chain events. It speaks the full Model Context Protocol: tools, resources, and prompts. Connect a hosted endpoint or run it locally via npx — both authenticate with a tp_ API key or an OAuth 2.0 access token. Source on GitHub, published as tracepass-mcp-server on npm. Listed in the official MCP Registry as eu.tracepass/tracepass.

What it is

MCP is an open protocol that lets an AI assistant call external tools and read external data through a single, standard interface. The TracePass MCP server is a thin, stateless adapter in front of the TracePass v1 API — it has no database of its own; every tool call and resource read goes straight through to the same API your other integrations use, so authentication, plan gating, and rate limits all behave identically. There are two ways to connect it. The hosted server runs at https://ai.tracepass.eu/mcp over HTTP — nothing to install, always current. The local server is the tracepass-mcp-server npm package, launched as a subprocess by your MCP client and speaking MCP over stdio.

Connecting (hosted)

Point your MCP client at the hosted endpoint and pass your API key as a Bearer token. Mint a key in the dashboard under Developer → API Keys — it is the same tp_ key the v1 API uses. Add this block to your client's MCP configuration:

json

{
  "mcpServers": {
    "tracepass": {
      "url": "https://ai.tracepass.eu/mcp",
      "headers": { "Authorization": "Bearer tp_YOUR_KEY" }
    }
  }
}

Connecting (local / npx)

For a local setup, your MCP client launches the npm package as a subprocess and talks to it over stdio. There is nothing to install ahead of time — npx fetches tracepass-mcp-server on first run. The API key is passed through the TRACEPASS_API_KEY environment variable instead of a header:

json

{
  "mcpServers": {
    "tracepass": {
      "command": "npx",
      "args": ["-y", "tracepass-mcp-server"],
      "env": {
        "TRACEPASS_API_KEY": "tp_YOUR_KEY"
      }
    }
  }
}

Tools

The TracePass v1 API operations are grouped into eight tools. Each takes an action plus action-specific args, so the assistant picks the tool by domain and the operation by action:

Tool	Actions
`tracepass_products`	`list, get, create, create_batch, update` — Catalog operations — browse, read, and create or update products.
`tracepass_passports`	`list, get, get_by_serial, compliance, registry_readiness, prepare_registry_upi, prepare_registry_upload_file, record_acceptance_test, get_condition_flags, get_condition_flags_by_serial, set_condition_flags, set_condition_flags_by_serial, create, get_qr, get_qr_by_serial, list_snapshots, get_snapshot, capture_measurements, capture_measurements_by_serial, list_measurements, list_measurements_by_serial, latest_measurements, latest_measurements_by_serial` — The passport lifecycle — list and read passports, look one up by serial number, create, fetch the QR code or a Data Matrix, and read the snapshot history, including the version valid at a given date.
`tracepass_passport_fields`	`update, update_by_serial` — Update individual template fields on a passport.
`tracepass_passport_parties`	`set, remove` — Set or remove economic-operator parties (manufacturer, importer, recycler, and so on) on a passport.
`tracepass_epcis`	`export, export_by_serial, capture, capture_job, query` — Read and write GS1 EPCIS 2.0 supply-chain events — export a passport's event history, capture new events, run a capture job, and query the event store.
`tracepass_templates`	`list, get` — Read the regulatory schema for each DPP category — what a compliant passport must contain and the EU regulation behind each required field. Lets the assistant advise on requirements before you create anything.
`tracepass_scope`	`check, catalogue_report, catalogue_run, catalogue_run_status` — Check whether a product type needs a Digital Product Passport, from when and under which act and article; read the catalogue-wide scope report; start and poll a catalogue run.
`tracepass_passport_lifecycle`	`record_registration, undo_registration, place_on_market, suspend, suspend_by_serial, archive, archive_by_serial, archive_product` — Irreversible and public-facing actions, kept apart so an “always allow” for reading never covers them: record a battery passport's registration in the EU DPP Registry (the operator registers on the Registry website) or send it to an EN 18222 registry API, suspend or archive a passport, and archive a product. The assistant must confirm each call with you.

Some write actions cost money or are irreversible. The server's tool descriptions tell the model this, but you should know it too: tracepass_passports with action create makes a draft passport. A draft takes no plan slot and is never charged; the plan limit and any per-passport overage charge apply when the passport is published in the dashboard. Archiving, suspending and placing on the market sit in their own tool, tracepass_passport_lifecycle, so an “always allow” for reading never covers them; its action archive is irreversible, so use suspend when you may need the passport back. The tracepass_epcis actions (capture, query, export) are included on every plan, Free included, and metered by events-per-month per the plan table on /pricing.

Who wrote a value stays on the record. An update through tracepass_passport_fields is written with the rights of whoever connected the assistant: an API key or an admin writes it as approved, and a connected app acting for an editor sends it to review, as the dashboard would. When the assistant found or inferred a value itself (web research, reading a document) rather than being told it, it passes source: "ai_suggested", and the value waits in the dashboard review queue for a person to approve. Fields that only the economic operator may state, or that must be measured, refuse such a value. Every change is recorded in the passport's history with the credential and the channel. Publishing is not available to the assistant; it stays in the dashboard.

Resources

Resources are read-only entity data the user attaches as conversation context, addressed by a tracepass:// URI. Two are static resources, the rest are resource templates the client completes with an id:

tracepass://products
tracepass://product/{id}
tracepass://passport/{id}
tracepass://passport/{id}/epcis
tracepass://passport/{id}/compliance
tracepass://passport/{id}/registry-readiness
tracepass://passport/{id}/snapshots
tracepass://templates
tracepass://template/{category}

Prompts

Prompts are reusable DPP workflows the MCP client surfaces to the user, typically as slash-commands. Each seeds the conversation so the assistant carries out the task the way TracePass intends — for example, always confirming before it creates a passport:

audit_passport
onboard_product
review_epcis_events
explain_dpp_requirements
compliance_gap_check
register_battery_passport

The compliance copilot in action

Put together, the templates tool and the prompts turn the assistant into a DPP compliance copilot — it knows what each category's regulation requires, not just how to push data. Here is a representative session for a battery manufacturer:

text

You  ▸  What does a compliant battery passport need, and which fields will be hardest to source?

TracePass copilot  ▸  Calling tracepass_templates(get, battery)…

  A battery DPP is governed by the EU Battery Regulation (EU) 2023/1542,
  mandatory from 18 Feb 2027. The template covers the Annex XIII field set. By
  access level:

    • Public (consumer-facing): manufacturer identity, battery
      category, weight, capacity, hazardous substances, recycled-
      content shares (Co, Pb, Li, Ni), carbon footprint, due-
      diligence report. — Art. 77, Annex XIII
    • Restricted (legitimate interest): cell materials (cathode,
      anode, electrolyte), dismantling and removal info, state of
      health, expected lifetime.
    • Authority-only: test reports, third-party audit results,
      recycled-content documentation.

  Hardest to source up front: the recycled-content shares and the
  carbon-footprint declaration — those usually live with your cell
  supplier. Want me to draft a supplier request for them?

You  ▸  Yes — and gap-check passport SN-2026-00042 before I publish it.

TracePass copilot  ▸  Running the compliance_gap_check prompt…

  Against the battery template, SN-2026-00042 has gaps to close
  before you publish:

    ✗ hazardousSubstances — empty (required, Annex XIII 1(a))
    ✗ extinguishingAgent — empty (required, Annex XIII 1(a))
    ⚠ recycler party — not set (flagged; does not block publishing)
    ⚠ stateOfHealth — present but pending review

  Everything else is approved. Fill the two empty required fields
  before you publish. Most important first: the hazardous-substances
  list — it usually needs a declaration from the cell supplier.

For regulatory questions — what EU law says for a product type, citing the article — see the DPP Assistant. It uses a dedicated set of regulatory tools and a separate MCP endpoint at https://ai.tracepass.eu/compliance/mcp.