MCP Auth PoC
Post-login data collection PoC
BPLAT-10181: checks the Auth0 behaviors SDD-008 assumes, against a blank Auth0 tenant.
Connect an MCP client
Add https://mcp-auth-poc-poc.dev.bonterralabs.io/api/mcp as a remote MCP server. Logging in runs the collection gate, and the whoami tool shows what the token carries.
Preview the screens
No login needed. Each link picks a tenancy scenario.
- Two products, three organizations
you@example.com - One product, one organization
you+alpha@example.com - Beta only
you+beta@example.com - No eligible products
you+none@example.com
Endpoints
| Method | Path | Purpose |
|---|---|---|
| POST | /api/mcp | Shared MCP endpoint. Lists only the tools whose scope the token holds. |
| GET | /.well-known/oauth-protected-resource/api/mcp | RFC 9728 metadata: resource, issuer, scopes. |
| POST | /api/collection/enrichment | Called by the collection gate Action on every token issuance. |
| POST | /api/collection/sessions | The collection page exchanges the gate's session token here. |
| GET | /api/collection/sessions/{id} | Steps to render, with options resolved on the server. |
| POST | /api/collection/sessions/{id}/submit | Validates and stores answers, returns the signed result. |
| GET / DELETE | /api/collection/me/values | The caller's stored values; DELETE clears them. |
| POST | /api/debug/obo | Runs the on-behalf-of exchange for the probe script. |