generated: '2026-08-02'
method: probed
status: published
source: https://api.clearstreet.com/v1/mcp
server:
  name: Clear Street MCP
  transport: http
  url: https://api.clearstreet.com/v1/mcp
  resource_name: Clear Street MCP
  vendor_statement: >
    Clear Street's developer page (https://www.clearstreet.com/api) advertises an MCP Server
    to "connect your AI assistant via Model Context Protocol", naming Claude and Gemini.
authorization:
  gated: true
  challenge: 'WWW-Authenticate: Bearer resource_metadata="https://api.clearstreet.com/.well-known/oauth-protected-resource/v1/mcp"'
  spec: RFC 9728 OAuth 2.0 Protected Resource Metadata
  protected_resource_metadata: https://api.clearstreet.com/.well-known/oauth-protected-resource/v1/mcp
  authorization_server: https://api.clearstreet.com/oauth/mcp
  authorization_endpoint: https://api.clearstreet.com/oauth/mcp/authorize
  token_endpoint: https://auth.clearstreet.io/oauth/token
  grant_types_supported: [authorization_code, refresh_token]
  code_challenge_methods_supported: [S256]
  token_endpoint_auth_methods_supported: [none, client_secret_post, client_secret_basic]
  scopes_supported: [openid, offline_access]
  bearer_methods_supported: [header]
tools:
  introspected: false
  reason: >
    tools/list requires an authenticated bearer token — an anonymous JSON-RPC POST returns
    401 Unauthorized with the RFC 9728 challenge above. The live tool set and per-tool
    inputSchema therefore require authenticated introspection. Clear Street publishes no
    llms.txt tool listing for the MCP server either, so no tool names are asserted here.
    See mcp/clear-street-tool-crosswalk.yml for the REST capability surface the server
    fronts, mapped by resource rather than by tool name.
x-evidence:
  fetched: '2026-08-02'
  probes:
  - {url: 'https://api.clearstreet.com/v1/mcp', method: 'POST tools/list', http_status: 401,
     content_type: 'text/plain; charset=utf-8', body: Unauthorized}
  - {url: 'https://api.clearstreet.com/v1/mcp', method: GET, http_status: 401}
  - {url: 'https://api.clearstreet.com/v1/mcp', method: 'POST initialize', http_status: 401}
  - {url: 'https://api.clearstreet.com/.well-known/oauth-protected-resource/v1/mcp', method: GET,
     http_status: 200, content_type: application/json}
  - {url: 'https://api.clearstreet.com/oauth/mcp/.well-known/oauth-authorization-server',
     method: GET, http_status: 200, content_type: application/json}
  - {url: 'https://api.clearstreet.com/v1/zzz-nonexistent', method: GET, http_status: 404,
     note: 'control probe — the API 404s unknown paths, so the 401 on /v1/mcp confirms a real mounted resource'}