generated: '2026-08-13'
method: probed
source: >-
  https://beacons.ai/.well-known/oauth-protected-resource (200) and a live POST of
  tools/list to https://beacons.ai/api/v001/creator/mcp (401 + WWW-Authenticate
  Bearer challenge)
name: Beacons Creator MCP
provider: Beacons.ai
status: live
deployment:
  mode: remote
  endpoint: https://beacons.ai/api/v001/creator/mcp
  auth: oauth
  verified: probed
transport: streamable-http
ownership: >-
  First-party. The endpoint is served from beacons.ai itself; the RFC 9728
  Protected Resource Metadata document at https://beacons.ai/.well-known/
  oauth-protected-resource names this exact resource, and the RFC 8414
  Authorization Server Metadata at the same origin declares issuer
  https://beacons.ai. No third-party or sibling-brand host is involved.
discovery:
  protected_resource_metadata: https://beacons.ai/.well-known/oauth-protected-resource
  resource_scoped_metadata: https://beacons.ai/.well-known/oauth-protected-resource/api/v001/creator/mcp
  authorization_server_metadata: https://beacons.ai/.well-known/oauth-authorization-server
authorization:
  scheme: OAuth 2.1 authorization code + PKCE
  bearer_methods: [header]
  scopes: [mcp:read]
  authorization_endpoint: https://beacons.ai/api/v001/oauth/authorize
  token_endpoint: https://beacons.ai/api/v001/oauth/token
  registration_endpoint: https://beacons.ai/api/v001/oauth/register
  dynamic_client_registration: true
  pkce_methods: [S256]
  note: >-
    Dynamic client registration is open (token_endpoint_auth_methods_supported
    includes "none"), but the only grant offered is authorization_code, so a token
    requires an interactive Beacons creator to consent in a browser. This
    enrichment pass did not register a client and did not obtain a token.
tools:
  status: gated
  count: null
  note: >-
    tools/list returns HTTP 401 with
    WWW-Authenticate: Bearer resource_metadata="https://beacons.ai/.well-known/
    oauth-protected-resource/api/v001/creator/mcp" — textbook RFC 9728 behaviour,
    but it means the live tool manifest and every inputSchema require an
    authenticated creator session. Beacons publishes no llms.txt tool list, no
    developer portal and no help-centre article naming this server, so there is no
    published fallback to enumerate tools from. NO TOOLS ARE LISTED HERE BECAUSE
    NONE COULD BE READ — nothing has been inferred from the product surface.
x-evidence:
- fetched: '2026-08-13'
  url: https://beacons.ai/.well-known/oauth-protected-resource
  method: GET
  http_status: 200
  content_type: application/json
- fetched: '2026-08-13'
  url: https://beacons.ai/api/v001/creator/mcp
  method: POST
  body: '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
  http_status: 401
  www_authenticate: Bearer resource_metadata="https://beacons.ai/.well-known/oauth-protected-resource/api/v001/creator/mcp"
- fetched: '2026-08-13'
  url: https://beacons.ai/api/v001/creator/mcp
  method: POST
  body: initialize (protocolVersion 2026-07-28)
  http_status: 401
observations:
- The scope name `mcp:read` is read-only, so the server as advertised exposes
  retrieval over a creator's Beacons data rather than write actions.
- The path segment `creator` implies the server is scoped to a single creator
  account rather than to the platform.
- The API is versioned in the path as `v001`.