MCP server and sign-in

    Agensi runs one remote MCP server over Streamable HTTP. New connections use the sign-in-first endpoint.

    EndpointBehaviour
    https://mcp.agensi.io/mcp/authDefault for new connections. Every request needs a valid OAuth token, search included.
    https://mcp.agensi.io/mcpOlder connections. Every tool call needs sign-in here too. Connecting and listing the tools works before sign-in, so the agent can start it.

    OAuth 2.1

    • Discovery: /.well-known/oauth-protected-resource on mcp.agensi.io, and /.well-known/oauth-authorization-server on mcp.agensi.io and www.agensi.io.
    • Registration: dynamic client registration is open. A redirect URI is required: https, localhost or a custom scheme such as claude://.
    • Flow: authorization code with PKCE, S256 only. Public clients.
    • Scopes: read to browse skills, creators and the user's library. install to buy and use skills, spending credit only after the user approves.
    • Tokens: access tokens last 1 hour. Refresh tokens last 30 days and rotate on every use. Reusing an old refresh token revokes the connection.
    • No API keys. Only OAuth tokens are accepted.

    One agent per account. When a new client receives its first token, every other client on that account loses access.