DEVELOPER GUIDE

Remote MCP

Use the stable HTTPS endpoint and OAuth discovery. Account linking is separate from directory approval.

Integration steps

MCP URL: https://tastepolicy.vercel.app/api/mcp. An unauthenticated request returns a 401 challenge with protected-resource metadata.
The client discovers /.well-known/oauth-protected-resource/api/mcp and /.well-known/oauth-authorization-server. Use authorization code with PKCE S256 and the exact resource audience.
The owner signs in and explicitly consents to scopes. Tools are discovered only after successful authorization. Refresh tokens rotate; reuse revokes the token family.
Tools evaluate choices, inspect authority, manage bounded leases and issue or verify proofs. Review each tool’s input, scopes and behavior annotations.
In ChatGPT use its current custom app/plugin workflow; in Claude use Customize → Connectors → Add → Custom → Web. Registration and a tool scan are not proof of actual conversation use. Live commissioning remains pending.

MCP: https://tastepolicy.vercel.app/api/mcp
OAuth issuer: https://tastepolicy.vercel.app
Resource: https://tastepolicy.vercel.app/api/mcp