generated: '2026-08-06' method: probed source: https://mcp.asknice.ly/.well-known/oauth-authorization-server description: >- AskNicely's REST API is API-key authenticated and has no OAuth surface. The only OAuth surface AskNicely operates is the authorization server fronting its remote MCP server (Ask NiceAI), which advertises a single coarse scope. There is no published scopes/permissions reference page — the scope set below is read verbatim from the RFC 8414 authorization-server metadata document. applies_to: AskNicely MCP Server (Ask NiceAI) schemes: - name: MCP OAuth 2.1 source: https://mcp.asknice.ly/.well-known/oauth-authorization-server issuer: https://mcp.asknice.ly flows: - flow: authorizationCode authorizationUrl: https://mcp.asknice.ly/authorize tokenUrl: https://mcp.asknice.ly/token pkce: [S256] refresh: true dynamic_client_registration: https://mcp.asknice.ly/register revocation: https://mcp.asknice.ly/revoke scopes: - scope: tools description: >- Access the Ask NiceAI MCP tool surface. AskNicely advertises exactly one scope; there is no read/write or per-resource scope decomposition, so consent is all-or-nothing over the tool set. flows: [authorizationCode] sources: ['https://mcp.asknice.ly/.well-known/oauth-authorization-server'] protected_resources: - resource: https://nicely.asknice.ly/mcp authorization_servers: [https://mcp.asknice.ly] scopes_supported: [tools] bearer_methods_supported: [header] source: https://mcp.asknice.ly/.well-known/oauth-protected-resource gaps: - No scopes or permissions reference page in AskNicely's documentation. - A single `tools` scope means no least-privilege decomposition for agent consent. - The REST API has no OAuth option at all; it is a single account-wide API key with no scoping. x-evidence: - {url: 'https://mcp.asknice.ly/.well-known/oauth-authorization-server', http_status: 200, fetched: '2026-08-06'} - {url: 'https://mcp.asknice.ly/.well-known/oauth-protected-resource', http_status: 200, fetched: '2026-08-06'}