Connect an AI assistant
BiohackList has a remote MCP server. An assistant such as a Grok bot can read the public catalog and, after you sign in, manage your lists, reviews, and self-reported stats. Nothing the assistant reads or writes here is medical advice.
Server URL
https://www.biohacklist.com/api/mcp
The same URL is on Account under Connect your AI. Use Streamable HTTP. Public catalog tools answer without a token. Tools that read or change your own data ask the assistant to sign you in.
Sign-in
Sign-in is OAuth. Clerk is the authorization server, and this site is the protected resource. Your assistant discovers the metadata at /.well-known/oauth-protected-resource/api/mcp, sends you to your BiohackList account, and then calls write tools with that token. The connector does not accept a user id inside a tool argument. Every write uses the account on the token, and only that account's rows.
In the Clerk dashboard, open OAuth applications and enable client registration so assistants can connect. Prefer Client ID Metadata Documents. Turn on Dynamic Client Registration only for clients that cannot use it. Set the default scopes to openid, profile, and email so a client that omits scope still receives a usable token.
Example client config
For a client that takes a remote URL:
{
"mcpServers": {
"biohacklist": {
"url": "https://www.biohacklist.com/api/mcp"
}
}
}Clients that only speak stdio can bridge with npx -y mcp-remote https://www.biohacklist.com/api/mcp. When a write tool needs your account, approve the BiohackList sign-in prompt.
What the assistant can do
Without an account: search and open listings, list categories, search and read blog posts, read a public profile, and read reviews on a listing.
With your account: read your profile, protocol, wishlist, lists, stats, and the public activity of people you follow. Update your username, display name, and bio. Add or remove a listing on your protocol or wishlist, with an optional note or dosage. Write, edit, or delete your own review. Set or delete your own self-reported stats. Follow or unfollow a member.
Private lists stay private. A stat set to only me is left out of other people's feeds. Stats shared with followers are visible to people who follow you. New stats default to only me.
What it cannot do
The connector cannot create or edit listings, categories, brands, or blog posts. Those stay on the existing admin API, which uses its own bearer secret. The connector never sees that secret. It also cannot mark a review verified or approve proof. Verification stays a manual admin step. Reviews posted here are unverified member notes.
A new review still follows the site rules: the account is at least 14 days old, the listing has been on your protocol or a list for at least 14 days, and you confirm the note is your own experience and was not paid for.
Limits and setup
Each member can make 40 connector changes per hour. Successful writes are logged with the Clerk user, profile, tool name, and time. The log does not store the text you sent.
Apply drizzle/0007_mcp.sql yourself in the Neon SQL editor when you want bios, dosage notes, and the write log. Do not run it from a deploy script, and do not treat this pull request as applying it to production. Until that file is applied, catalog reads still work. Saving a bio or a dosage, and every write, tells the assistant the migration is still pending.
Self-reported stats use the merged profile_stats table and the metric list in src/lib/stat-metrics.ts. A new stat defaults to only me. The connector cannot mark one verified.