Developers · MCP server

Trellia data, in your platform.

Trellia runs a standard remote Model Context Protocol (MCP) server. Advisers connect with their own Trellia login, and your platform or AI agent reads the managed account portfolios they can see.

MCP server URLhttps://mcp.trelliawealth.com.au/mcp

Endpoints.

An unauthenticated request to the MCP server returns 401 with a resource_metadata link, so clients that support OAuth discovery find the rest themselves.

MCP server	`https://mcp.trelliawealth.com.au/mcp`
Protected resource metadata	`https://mcp.trelliawealth.com.au/.well-known/oauth-protected-resource`
Authorization server metadata	`https://portal.trelliawealth.com.au/.well-known/oauth-authorization-server`
Authorization endpoint	`https://portal.trelliawealth.com.au/oauth/authorize`
Token endpoint	`https://portal.trelliawealth.com.au/oauth/token`
Scope	`mcp:adviser:read`

Authorisation flow.

Authorization code with PKCE (S256). Send the MCP server URL as resource on both the authorization and token requests. Partner platforms are public OAuth clients with no client secret, using a client ID and exact callback URLs registered with Trellia; dynamic client registration is not supported.

Generate a PKCE verifier and S256 challenge, plus a random state, and store them against the adviser's session.
Send the adviser to the authorization endpoint. They sign in with their own Trellia login and approve a consent screen that names your platform.
Trellia redirects to your registered callback with the code and the original state. Reject a state mismatch.
Exchange the code at the token endpoint, then send the access token as a bearer token on every MCP request.

GET https://portal.trelliawealth.com.au/oauth/authorize
  ?response_type=code
  &client_id=<YOUR_CLIENT_ID>
  &redirect_uri=<YOUR_REGISTERED_CALLBACK>
  &scope=mcp%3Aadviser%3Aread
  &state=<OPAQUE_STATE>
  &code_challenge=<PKCE_CHALLENGE>
  &code_challenge_method=S256
  &resource=https%3A%2F%2Fmcp.trelliawealth.com.au%2Fmcp

curl -X POST https://portal.trelliawealth.com.au/oauth/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=authorization_code" \
  -d "code=<AUTHORIZATION_CODE>" \
  -d "client_id=<YOUR_CLIENT_ID>" \
  -d "redirect_uri=<YOUR_REGISTERED_CALLBACK>" \
  -d "code_verifier=<PKCE_VERIFIER>" \
  -d "resource=https://mcp.trelliawealth.com.au/mcp"

Calling the server.

Stateless Streamable HTTP. Call initialize, then tools/list. Start with list_portfolios and {"discovery_only": true} to find the adviser's portfolios, then pass the returned IDs or codes to the other tools.

curl -X POST https://mcp.trelliawealth.com.au/mcp \
  -H "Authorization: Bearer <ACCESS_TOKEN>" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-11-25","capabilities":{},"clientInfo":{"name":"your-platform","version":"1.0.0"}}}'

Tools.

Every tool is read-only and returns only portfolios the connected adviser can access.

Tool	Returns
`list_portfolios`	The portfolios, suites and platforms you can access, with codes, fees, inception dates and factsheet links.
`get_nested_portfolios`	Which portfolios are composites of other portfolios.
`get_portfolio_holdings`	Model holdings and weights by date.
`get_portfolio_performance`	Period returns (1 month to 10 years) and daily return series.
`get_portfolio_fees`	RG97 portfolio and underlying fund fees, including fee tiers.
`get_saa`	Target, minimum and maximum weights by asset class.
`get_portfolio_updates`	Published portfolio updates, including trade rationale and rebalance commentary.

Errors.

OAuth and MCP responses your platform should handle.

Response	Meaning
`400 invalid_request`	A required parameter is missing, or the callback URL is not registered for your client.
`400 invalid_client`	Unknown client ID.
`400 invalid_target`	Missing or wrong resource. Send the MCP server URL.
`400 invalid_grant`	Code expired, already used, or PKCE failed. Restart authorisation.
`401 invalid_token`	Token expired or revoked. Ask the adviser to reconnect.
`access_denied`	Authorization redirect: the adviser declined, or can't connect your platform. Sent to your callback as the error query parameter.
`403 Forbidden`	MCP server: the adviser is no longer enabled for your integration. Ask Trellia to confirm their access.

Access and security

Common questions.

See our Privacy Policy for how Trellia handles information.

Which advisers can connect?

Advisers with an active, approved Trellia account and your integration enabled. Your platform sees only the portfolios that adviser can see in Trellia.

How long does a connection last?

Access tokens last 90 days and there are no refresh tokens. When a request returns 401 invalid_token, ask the adviser to reconnect.

How do advisers disconnect?

From Integrations in Trellia, at any time. This ends only your platform's access, and the next request returns 401.

What data does the server return?

Product and portfolio data only, never personal information about advisers' clients. A request for a portfolio the adviser cannot access returns not found, so it does not reveal whether the portfolio exists.

Where is it hosted, and what is logged?

Trellia is hosted in Australia. Each request is recorded (the tool, the portfolios requested and when) for security and audit. Never log access tokens or PKCE verifiers on your side.

Partner with Trellia