MCP Authentication Status

OAuth metadata, PKCE, dynamic registration, scopes, and the current protected-runtime limitation.

Overview

The hosted edge publishes an authorization-code flow for public clients using PKCE S256. Dynamic client registration is available for approved exact callback forms. Client ID metadata documents are explicitly not supported.

Published OAuth Contract

Field	Current value
Resource	https://mcp.altifigence.com
Transport	https://mcp.altifigence.com/mcp
Authorization metadata	https://mcp.altifigence.com/.well-known/oauth-authorization-server
Dynamic registration	https://mcp.altifigence.com/register
Token client type	Public; no client secret
PKCE	S256 required
Client ID metadata document	Not supported

Dynamic registration accepts only the exact callback shapes allowed by policy, including the approved ChatGPT callback and local localhost or 127.0.0.1 loopback forms. A wildcard or callback captured from another client is not valid.

Scopes

Scope	Intended use
https://mcp.altifigence.com/tools.list	MCP initialization and tool discovery policy
https://mcp.altifigence.com/tools.call	Allowed tool invocation policy

These scopes are active OAuth policy, but the current protected route does not implement MCP initialization or tool listing. A token with both scopes does not remove that runtime limitation.

Credential Handling

The MCP flow does not accept desktop licence files, website cookies, or AI-provider keys as Altifigence bearer tokens. Never place a client secret into a public PKCE configuration and never forward an OAuth token to an unrelated tool or service.