HTTP endpoints

The server exposes four things: the MCP transport, two OAuth discovery documents, and CORS preflight.

Method	Path	Purpose
POST / GET	/mcp	The Streamable HTTP MCP transport. Requires a Bearer token.
GET	/.well-known/oauth-protected-resource	Protected Resource Metadata (RFC 9728).
GET	/.well-known/oauth-authorization-server	Authorization Server Metadata.
OPTIONS	any	CORS preflight.

Host: https://mcp.binclusive.io.

/mcp

Requires Authorization: Bearer <token>, where the token is either an OAuth 2.1 access token or a b8e_ machine credential.

A request with no Bearer prefix, or with a token that fails verification, is answered:

HTTP/1.1 401 Unauthorized
Content-Type: application/json
WWW-Authenticate: Bearer resource_metadata="https://mcp.binclusive.io/.well-known/oauth-protected-resource"
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: WWW-Authenticate

{"error":"unauthorized"}

That WWW-Authenticate header is what triggers OAuth discovery and Dynamic Client Registration in a spec-compliant client.

A machine (b8e_) caller is admitted at this layer, but reaches exactly one tool — create_ticket. Every other tool requires a signed-in person and answers a machine caller with Not authenticated.

/.well-known/oauth-protected-resource

{
  "resource": "https://mcp.binclusive.io",
  "authorization_servers": ["https://pasaport.binclusive.io/api/auth"],
  "scopes_supported": ["openid", "profile", "email", "offline_access"],
  "bearer_methods_supported": ["header"]
}

Cached for one hour (Cache-Control: public, max-age=3600).

/.well-known/oauth-authorization-server

Returns the authorization server’s own metadata document verbatim. Cached for one hour.

CORS

Preflight answers with:

Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: Content-Type, Authorization

The 401 above also carries Access-Control-Allow-Origin: * and exposes WWW-Authenticate, so a browser-based client can read the header it needs to start discovery.