One endpoint, any MCP client. Pick your tool — the setup takes under a minute.
No passwords, no API keys to paste. The MCP client discovers everything from the endpoint and runs a standard OAuth 2.1 authorization-code flow with PKCE; the identity provider is Google (OIDC).
| Mechanism | Detail |
|---|---|
| Protected Resource Metadata | /.well-known/oauth-protected-resource — RFC 9728 |
| Authorization Server Metadata | /.well-known/oauth-authorization-server — RFC 8414 |
| Client registration | Dynamic (RFC 7591) at /oauth/register — clients self-register |
| Flow | Authorization Code + PKCE (S256), OAuth 2.1 |
| Identity | Google OIDC; token bound to your account |
| Scope | mcp, bearer token in the Authorization header |
Inspect discovery yourself — it's public and unauthenticated:
curl -s https://planner.monopoly-gold.com/.well-known/oauth-protected-resource | jq
{
"resource": "https://planner.monopoly-gold.com/_mcp",
"authorization_servers": ["https://planner.monopoly-gold.com"],
"bearer_methods_supported": ["header"],
"scopes_supported": ["mcp"],
"resource_name": "Planner MCP",
"resource_documentation": "https://planner.monopoly-gold.com/api/capabilities"
}
Each account is a separate tenant. The goal tree, projects, evidence and history are scoped to their owner at the storage layer — not per-tool, so every tool, REST route and resource is isolated by construction. A direct ID from another tenant resolves to nothing.
| Symptom | Cause / fix |
|---|---|
| ! Needs authentication | Token missing or expired. Re-authenticate in your client. |
| 401 on /_mcp | Expected without a token — it's the auth challenge that drives discovery. Authenticate. |
| Redirect page error | If the callback tab can't connect, copy the full address-bar URL back to the client to finish the flow manually. |
| Stuck after token change | Remove and re-add the server in your client's MCP settings. |