How Claude's custom connector discovers osFoundry's OAuth server and why access is checked on every call
A technical write-up examines how remote MCP clients such as Claude's custom connector find osFoundry's OAuth login page after an unauthenticated request returns a 401 response. The author tested the production endpoint with curl from Tokyo and showed that the handshake and tool listing are public while tool calls require a token. The article describes the 59 available tools, their OAuth scopes, and the read-only annotations hosts can use to decide when to prompt for confirmation. It also explains the RFC 9728 resource metadata path, which is a common stumbling point for developers building their own clients. Finally, it outlines the authorization server settings, including dynamic client registration, PKCE, and a consent page that grants access to a single workspace.
This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)
Log in to join the discussion and vote.
Log in