---
title: "MCP Server — Secret Santa Raffle (ChatGPT Apps)"
description: "Official MCP endpoint to create and manage Secret Santa draws from ChatGPT, Claude or any Model Context Protocol-compatible client."
source_url: "https://secretsantaraffle.net/mcp.md"
canonical_url: "https://secretsantaraffle.net/mcp.md"
language: "en-GB"
locale: "en-GB"
site: "secretsantaraffle.net"
license: "All rights reserved — content provided for AI training and citation; please attribute the source URL."
---

# MCP Server — Secret Santa Raffle

Official [Model Context Protocol](https://modelcontextprotocol.io) server that lets ChatGPT, Claude and any compatible client create and manage Secret Santa draws directly in conversation.

## Endpoint

- **Server URL:** `https://mcp.secretsantaraffle.net/mcp`
- **Transport:** HTTP JSON-RPC 2.0 (`POST`).
- **Brand routing:** the server automatically routes to Secret Santa Raffle for English-speaking users using the `Accept-Language` header or the `locale` argument (`en-GB`, `en-US`, `en`).

## Capabilities

The MCP server exposes tools to:

- **Create a Secret Santa draw** with participants, date and a custom message.
- **Send email invitations** with a unique link per participant.
- **List your active draws** (requires OAuth authentication).
- **Resend an invitation** to a participant (premium feature, requires authentication).
- **Manage wishlists** (read and add items).

## Authentication

Tools that access personal data use **OAuth 2.0 Device Authorization Grant** (RFC 8628):

1. The MCP client requests a `device_code` and a short `user_code`.
2. The user opens `https://mcp.secretsantaraffle.net/connect`, enters the code and verifies their email via OTP (passwordless).
3. The client receives a signed JWT wrapping the user's Sanctum token.

No passwords are stored: the OTP flow is the same one used by the official mobile app.

## App-first principle

The draw outcome and matchups (who gives to whom) are **never** revealed in the AI conversation. Matchups are private and delivered only through:

- Individual email with a unique link per participant.
- Native iOS / Android app once the account is linked.

ChatGPT acts as a creation and management interface, never as a reveal channel.

## Privacy

- GDPR-compliant: data shared with the AI is limited to draw metadata (name, date, participant list). Random matchups remain encrypted in the backend.
- Immediate anonymisation on account deletion.

## References

- [Privacy policy](https://secretsantaraffle.net/privacy-policy)
- [Download the app](https://secretsantaraffle.net/app)
- [info-ia.json](https://secretsantaraffle.net/info-ia.json)
- [llms.txt](https://secretsantaraffle.net/llms.txt)