Discovery and lazy auth

Connecting to Uely’s MCP endpoint asks you to sign in. Listing the tools does not.

Sign in to connect

initialize answers 401 when no token is sent, with a WWW-Authenticate challenge. Clients that only open a browser when the connection itself is refused, Cursor included, start login there. tools/list, resources/list, prompts/list and ping still answer without a token.

curl -s https://api.uely.ch/mcp/ \
  -H 'Accept: application/json, text/event-stream' \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}'

That returns all 15 tools, whether or not you have a token.

Hinweis

The list does not grow when you authenticate. Listing is discovery; calling is access. Eight tools work anonymously and the rest need a scope. You find out which by calling one, not by comparing two lists.

The 401 tells you what to do

Call a protected tool without a token and the answer is a 401 carrying everything a client needs to recover:

WWW-Authenticate: Bearer error="invalid_token",
  error_description="Authentication required for this tool.",
  resource_metadata="https://api.uely.ch/.well-known/oauth-protected-resource/mcp",
  scope="ask"

Two things matter there. scope names exactly what that tool needs, so you can ask for one scope rather than all four. And resource_metadata is the path-scoped document. Note the /mcp suffix; the bare /.well-known/oauth-protected-resource describes the identity plane and is not what you want.

The discovery chain

GET https://api.uely.ch/.well-known/oauth-protected-resource/mcp
   → authorization_servers: ["https://uely.ch"]

GET https://uely.ch/.well-known/oauth-authorization-server
   → authorization_endpoint (on uely.ch), token_endpoint and registration_endpoint (on api.uely.ch)

A client that looks up authorization-server metadata on api.uely.ch first is sent to uely.ch (302). authorization_endpoint is https://uely.ch/oauth/authorize. Token exchange and client registration stay on api.uely.ch.

The protected-resource document also lists the product scopes. The authorization-server document lists those plus openid and profile.

REST discovery

The OpenAPI document is at https://api.uely.ch/openapi.json. Its AgentOAuth2 security scheme lists the scopes in Authorize, with English descriptions.

REST routes on the allowlist behave the same way as MCP tools: no credential gets you a 401 with a WWW-Authenticate naming the scope, not a 404.