generated: '2026-08-09'
method: probed
source: https://cloud9.gg/.well-known/oauth-authorization-server
docs: null
description: >-
  Cloud9's only OAuth surface is the authorization server advertised on cloud9.gg for its remote
  MCP server. It declares a single coarse scope, `mcp`. Cloud9 publishes no developer program, no
  scope or permission reference, and no OpenID Connect discovery document on any host
  (/.well-known/openid-configuration returns 404). The anonymous WordPress REST API has no OAuth
  surface at all — reads need no credential and writes use WordPress application passwords.
schemes:
- name: Cloud9MCPOAuth
  type: oauth2
  source: https://cloud9.gg/.well-known/oauth-authorization-server
  issuer: https://cloud9.gg
  flows:
  - flow: authorizationCode
    authorizationUrl: https://cloud9.gg/oauth/authorize
    tokenUrl: https://cloud9.gg/oauth/token
    revocationUrl: https://cloud9.gg/oauth/revoke
    pkce: required
    code_challenge_methods: [S256]
    refresh_tokens: true
    client_authentication: none (public client)
    dynamic_client_registration: >-
      No RFC 7591 registration_endpoint is advertised. The server sets
      client_id_metadata_document_supported: true, so clients identify themselves with a
      client-ID metadata document URL rather than pre-registering.
scopes:
- scope: mcp
  description: >-
    Access the Cloud9 MCP server at https://cloud9.gg/wp-json/mcp/mcp-oauth-server. Coarse,
    single-scope model — the authorization server advertises no finer-grained read/write split,
    so a token that can read content can also invoke any write ability the adapter registered.
  flows: [authorizationCode]
  sources: [https://cloud9.gg/.well-known/oauth-authorization-server]
  protected_resource: https://cloud9.gg/wp-json/mcp/mcp-oauth-server
not_applicable:
- surface: Cloud9 WordPress REST API (wp/v2)
  reason: >-
    No OAuth. Anonymous reads require no credential; writes are authenticated with WordPress
    application passwords issued at /wp-admin/authorize-application.php. There is no scope
    surface to record — WordPress capabilities/roles do the authorization.
- surface: Cloud9 Store JSON endpoints (Shopify)
  reason: Anonymous platform endpoints. No authorization surface is exposed publicly.
x-evidence:
  fetched: '2026-08-09'
  probes:
  - url: https://cloud9.gg/.well-known/oauth-authorization-server
    status: 200
  - url: https://cloud9.gg/.well-known/oauth-protected-resource
    status: 200
  - url: https://cloud9.gg/.well-known/openid-configuration
    status: 404