Discovery and lazy auth

You can connect to Uely’s MCP endpoint with no credential at all, and you should — it is how you find out what is on offer and where to authenticate.

Connect first, authenticate later

initialize and tools/list answer without a token. So do resources/list, prompts/list and ping.

curl -s https://api.uely.ch/mcp/ \
  -H 'Accept: application/json, text/event-stream' \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}'

That returns all 27 tools, whether or not you have a token.

Hinweis

The list does not grow when you authenticate. Listing is discovery; calling is access. Eight tools work anonymously, seventeen need a scope, and you find out which by calling one — not by comparing two lists.

The 401 tells you what to do

Call a protected tool without a token and the answer is a 401 carrying everything a client needs to recover:

WWW-Authenticate: Bearer error="invalid_token",
  error_description="Authentication required for this tool.",
  resource_metadata="https://api.uely.ch/.well-known/oauth-protected-resource/mcp",
  scope="ask"

Two things matter there. scope names exactly what that tool needs, so you can ask for one scope rather than all nine. And resource_metadata is the path-scoped document — note the /mcp suffix; the bare /.well-known/oauth-protected-resource describes the identity plane and is not what you want.

The discovery chain

GET https://api.uely.ch/.well-known/oauth-protected-resource/mcp
   → authorization_servers: ["https://uely.ch"]

GET https://uely.ch/.well-known/oauth-authorization-server
   → authorization_endpoint, token_endpoint, registration_endpoint

The protected-resource document also lists the nine product scopes.

Achtung

The authorization-server document advertises scopes_supported: ["openid", "profile"] — the identity vocabulary. The product scopes are advertised on the protected-resource document instead. A strict client that validates requested scopes against the authorization-server document will not find ask there.

This is a known inconsistency in what we serve, recorded here rather than smoothed over. Request the product scopes anyway; the authorization endpoint accepts them.

REST discovery

The OpenAPI document is at https://api.uely.ch/openapi.json. Its AgentOAuth2 security scheme carries the same nine scopes with English descriptions.

REST routes on the allowlist behave the same way as MCP tools: no credential gets you a 401 with a WWW-Authenticate naming the scope, not a 404.