Summary
Expose Sorare's GraphQL API as an MCP server with AnythingMCP. Bcrypt-salted login, 30-day JWT caching, and 19 ready-to-use tools (5 GraphQL builtins + 14 dedicated) for cards, players, lineups, and the transfer market.
Try asking
Example prompts for Sorare Fantasy Football
Click any prompt to copy it. Paste into Claude, ChatGPT, Cursor, Gemini, Copilot or OpenClaw to run it against this connector.
Claude is AI and can make mistakes. Please double-check responses.
Self-hosted only. Sorare refuses requests from datacenter IP addresses, and AnythingMCP Cloud runs in a datacenter, so this connector is not available on AnythingMCP Cloud. It works on an AnythingMCP instance you run yourself on a computer or server with a regular home or office internet connection.
Sorare on the Model Context Protocol
Sorare is the largest licensed NFT fantasy sports game, with full GraphQL coverage over players, cards, auctions, and So5 lineups. AnythingMCP wraps that GraphQL API as an MCP server so any agent — Claude, ChatGPT, OpenClaw, Cursor, your own — can read and act on Sorare data with natural language.
The Sorare adapter ships built-in. There is no SDK to maintain, no token plumbing to write: the engine performs the salt fetch + bcrypt + login handshake the first time you call a tool, caches the resulting JWT for 30 days, and re-issues it transparently on any 401.
Why Sorare is awkward without AnythingMCP
| Step | What Sorare requires |
|---|---|
| 1 | GET /api/v1/users/{email} to retrieve a per-account bcrypt salt |
| 2 | bcrypt.hashSync(plainPassword, salt) client-side |
| 3 | GraphQL signIn mutation with the bcrypt hash |
| 4 | Store the JWT (~30-day lifetime) and pass Authorization: Bearer <jwt> + JWT-AUD: <aud> headers on every call |
That's the entire LOGIN_TOKEN auth profile, declared once as JSON in the adapter spec. No client code to maintain.
🔒 The video is embedded via the two-click consent pattern — nothing reaches Google until you press Play.
Install
curl -fsSL https://raw.githubusercontent.com/HelpCode-ai/anythingmcp/main/docker-compose.quickstart.yml -o docker-compose.yml
printf 'JWT_SECRET=%s\nENCRYPTION_KEY=%s\n' "$(openssl rand -hex 32)" "$(openssl rand -hex 32)" > .env
docker compose up -d
- Open
http://localhost:3000and register. The first account becomes the admin. - Open the connector store (
http://localhost:3000/connectors/store), pick Sorare, fill in the credentials it asks for (some connectors need none) and install it. - Under MCP Servers, create a server and assign the Sorare connector to it. On the server's page, copy the MCP endpoint (
http://localhost:4000/mcp/<server-id>) and generate a key under API keys.
The quickstart listens on localhost only. For an instance that other people or cloud-based AI clients can reach, clone the repository and run ./setup.sh, which sets up a domain, HTTPS and OAuth (deployment guide).
Available tools
| Tool | What it returns |
|---|---|
sorare_current_user | Authenticated user's slug, email, nickname |
sorare_get_card_by_slug | Card metadata, owner, current auction |
sorare_search_player | Players by name + club + country |
sorare_list_player_cards | Recent cards minted for a player |
sorare_list_my_cards | Cards owned by the authenticated user |
sorare_get_lineup | So5 lineup score, rank, reward, appearances |
sorare_wallet_balance | Get the authenticated user's wallet balances in ETH (wei) and the three fiat reference currencies (EUR, USD, GBP) |
sorare_user_by_slug | Fetch another Sorare user's public profile by slug — nickname, status, and So5 lineup count |
sorare_player_recent_scores | Return the most recent So5 scores for a football player slug, with position and game date |
sorare_token_prices | Recent sale history for cards of a specific player + rarity |
sorare_get_auction | Get a specific Sorare auction by id, including cards on auction, current price, best bid, and end date |
sorare_my_trophies_summary | Summary of the authenticated user's So5 results: total final rankings, podium finishes, and lifetime card / monetary rewards |
sorare_player_floor_price | Get the cheapest currently-listed card for a player at a given rarity |
sorare_live_sale_offers | List currently-live single-sale offers on the secondary market (Sorare's 'transfer market') |
Token lifecycle
The JWT lives in connector_auth_cache (AES-256-GCM encrypted), refreshed proactively when it falls within 24 h of expiredAt and replaced on the first 401. You can revoke it with DELETE FROM connector_auth_cache WHERE connector_id = '<id>' — the next tool call will re-login from scratch.
Next steps
Was this guide helpful?
