{
 "categories": [
  "finance",
  "fintech"
 ],
 "deployment": "saas",
 "evidence": [
  {
   "date": "2026-10-14",
   "fact": "homepage",
   "note": "Carta presents one private-capital platform for equity management, fund administration, and legal and compliance, and points Claude plugins at cap table, fund admin, and CRM tasks.",
   "source": "https://carta.com/",
   "tier": "declared"
  },
  {
   "date": "2026-10-14",
   "fact": "vendor",
   "note": "The homepage and its organization schema identify the company as Carta.",
   "source": "https://carta.com/",
   "tier": "declared"
  },
  {
   "date": "2026-10-14",
   "fact": "license",
   "note": "The homepage offers a demo request rather than a public free plan.",
   "source": "https://carta.com/",
   "tier": "declared"
  },
  {
   "date": "2026-10-14",
   "fact": "modalities.api.exists",
   "note": "The quickstart tells developers to register a playground app, choose an OAuth grant type and scopes, and save the client_id and client_secret.",
   "source": "https://docs.carta.com/api-platform/guides/getting-started/quickstart-guide/",
   "tier": "declared"
  },
  {
   "date": "2026-10-14",
   "fact": "modalities.api.kinds[0]",
   "note": "API calls are HTTPS requests to https://api.carta.com/ with Authorization: Bearer after the OAuth token exchange.",
   "source": "https://docs.carta.com/api-platform/guides/guides/authorization/using-the-authorization-code-flow",
   "tier": "declared"
  },
  {
   "date": "2026-10-14",
   "fact": "modalities.api.auth[0]",
   "note": "The authorization-code flow uses GET https://login.app.carta.com/o/authorize/ and POST https://login.app.carta.com/o/access_token/ with grant_type AUTHORIZATION_CODE. The authorization code expires after 60 seconds.",
   "source": "https://docs.carta.com/api-platform/guides/guides/authorization/using-the-authorization-code-flow",
   "tier": "declared"
  },
  {
   "date": "2026-10-14",
   "fact": "modalities.api.coverage",
   "note": "Production API calls use https://api.carta.com/. Access tokens last one hour and refresh tokens last 14 days. Scope selection on the quickstart means access is resource-gated.",
   "source": "https://docs.carta.com/api-platform/guides/references/endpoints-configuration/",
   "tier": "declared"
  },
  {
   "date": "2026-10-14",
   "fact": "modalities.api.docs",
   "note": "The developer quickstart is the public entry point for creating an OAuth app.",
   "source": "https://docs.carta.com/api-platform/guides/getting-started/quickstart-guide/",
   "tier": "declared"
  },
  {
   "date": "2026-10-14",
   "fact": "modalities.mcp.first_party",
   "note": "Carta documents Cap Table, Investors, and CRM plugins and the remote MCP URL https://mcp.app.carta.com/mcp with transport HTTP.",
   "source": "https://docs.carta.com/api-platform/guides/guides/claude-mcp-setup",
   "tier": "declared"
  },
  {
   "date": "2026-10-14",
   "fact": "modalities.mcp.verdict",
   "note": "The carta/plugins README says the repository is the official read-only mirror of Carta plugins for agents, including carta-cap-table, carta-crm, and carta-investors.",
   "source": "https://github.com/carta/plugins",
   "tier": "declared"
  },
  {
   "date": "2026-10-14",
   "fact": "modalities.data_access.export[0]",
   "note": "The token response is JSON, and subsequent API calls use the bearer access token against https://api.carta.com/.",
   "source": "https://docs.carta.com/api-platform/guides/guides/authorization/using-the-authorization-code-flow",
   "tier": "declared"
  },
  {
   "date": "2026-10-14",
   "fact": "verdict.scores.api",
   "note": "OAuth authorization-code access is documented, including token lifetimes on the endpoints page. This pass did not open the scoped resource reference, so the API is a usable gated path rather than a fully mapped one.",
   "source": "https://docs.carta.com/api-platform/guides/guides/authorization/using-the-authorization-code-flow",
   "tier": "declared"
  },
  {
   "date": "2026-10-14",
   "fact": "verdict.scores.mcp",
   "note": "Carta operates the hosted MCP and three named plugins. Cap table and investor plugins are query-oriented, CRM includes writes, and results follow the connected user's permissions. That is official useful coverage with a permission gate.",
   "source": "https://docs.carta.com/api-platform/guides/guides/claude-mcp-setup",
   "tier": "declared"
  },
  {
   "date": "2026-10-14",
   "fact": "freshness.watch[0].url",
   "note": "Opened the Carta plugin and MCP setup guide, including https://mcp.app.carta.com/mcp.",
   "source": "https://docs.carta.com/api-platform/guides/guides/claude-mcp-setup",
   "tier": "declared"
  },
  {
   "date": "2026-10-14",
   "fact": "freshness.watch[1].url",
   "note": "Opened the authorization-code flow, including the authorize and token URLs and the 60-second code lifetime.",
   "source": "https://docs.carta.com/api-platform/guides/guides/authorization/using-the-authorization-code-flow",
   "tier": "declared"
  },
  {
   "date": "2026-10-14",
   "fact": "freshness.watch[2].url",
   "note": "Opened the production OAuth endpoint table and the one-hour access-token and 14-day refresh-token lifetimes.",
   "source": "https://docs.carta.com/api-platform/guides/references/endpoints-configuration/",
   "tier": "declared"
  }
 ],
 "freshness": {
  "last_verified": "2026-10-14",
  "volatility": "medium",
  "watch": [
   {
    "type": "docs",
    "url": "https://docs.carta.com/api-platform/guides/guides/claude-mcp-setup"
   },
   {
    "type": "docs",
    "url": "https://docs.carta.com/api-platform/guides/guides/authorization/using-the-authorization-code-flow"
   },
   {
    "type": "docs",
    "url": "https://docs.carta.com/api-platform/guides/references/endpoints-configuration/"
   }
  ]
 },
 "homepage": "https://carta.com/",
 "id": "carta",
 "license": "commercial",
 "modalities": {
  "agent_docs": {
   "llms_txt": "unknown"
  },
  "api": {
   "auth": [
    "oauth2"
   ],
   "coverage": "partial",
   "docs": "https://docs.carta.com/api-platform/guides/getting-started/quickstart-guide/",
   "exists": true,
   "kinds": [
    "rest"
   ]
  },
  "cli": {
   "exists": "unknown"
  },
  "computer_use": {
   "issues": [],
   "viability": "unknown"
  },
  "data_access": {
   "export": [
    "json"
   ],
   "import": []
  },
  "extensibility": {
   "scripting": [],
   "webhooks": "unknown"
  },
  "integrations": {
   "make": "unknown",
   "n8n": "unknown",
   "power_automate": "unknown",
   "zapier": "unknown"
  },
  "mcp": {
   "first_party": true,
   "third_party": [],
   "verdict": "official"
  },
  "rpa": {
   "drivability": "unknown",
   "notes": "No repeatable UI probe was run. Cap table, fund, and CRM questions are documented through Carta's OAuth API and hosted MCP plugins.\n",
   "ui_stack": [
    "web-dom"
   ],
   "vendor_support": []
  },
  "sdk": {
   "exists": "unknown",
   "languages": [],
   "official": "unknown"
  }
 },
 "name": "Carta",
 "platforms": [
  "web"
 ],
 "related": {
  "alternatives": [],
  "our_products": []
 },
 "schema_version": 1,
 "score_version": 1,
 "status": "active",
 "vendor": "Carta",
 "verdict": {
  "best_path": "mcp",
  "scores": {
   "api": 6,
   "cli": null,
   "computer_use": null,
   "integrations": null,
   "mcp": 7,
   "overall": 7,
   "rpa": null
  },
  "summary": "Carta is automatable today through a vendor-hosted MCP server and a scoped OAuth API. This record is the Carta private-capital platform covering cap table, fund administration, and Carta CRM. It is not a separate equity-admin vendor. The API uses OAuth 2.0. A playground app is created in the developer portal and receives a client_id and client_secret. The authorization-code flow redirects the user to https://login.app.carta.com/o/authorize/ and exchanges the code at POST https://login.app.carta.com/o/access_token/ with HTTP Basic client credentials and grant_type AUTHORIZATION_CODE. The code expires after 60 seconds. Access tokens are bearer tokens sent to https://api.carta.com/. The endpoints page says an access token lasts one hour and a refresh token lasts 14 days. Scopes are chosen when the app is registered. Carta also documents plugins for Claude and other MCP clients. The remote server is https://mcp.app.carta.com/mcp over HTTP. Carta Cap Table and Carta Investors are query plugins. Carta CRM supports search, create, and update. All three authenticate with the user's Carta OAuth login, and data access follows that user's permissions. The public github.com/carta/plugins repository is a read-only mirror of those plugins, not the server implementation. Plugin support on the setup page is plugins@carta.com. iPaaS catalogs were not opened. Computer-use viability is unassessed. MCP scores 7 and is the best path because the hosted server and named plugins are the documented agent interface. The API scores 6 because the OAuth flow is documented while this pass did not open the resource catalog behind the scopes.\n"
 }
}