generated: '2026-07-31'
method: probed
status: published
source: https://www.dispatchhealth.com/.well-known/oauth-protected-resource
discovery:
  protected_resource_metadata: https://www.dispatchhealth.com/.well-known/oauth-protected-resource
  authorization_server_metadata: https://www.dispatchhealth.com/.well-known/oauth-authorization-server
  rest_route_index: https://www.dispatchhealth.com/wp-json/mcp
  route_index_file: dispatchhealth-wp-json-mcp-routes.json
servers:
- name: mcp-oauth-server
  transport: http
  url: https://www.dispatchhealth.com/wp-json/mcp/mcp-oauth-server
  methods: [POST, GET, DELETE]
  auth: oauth2
  auth_gated: true
  probe:
    method: tools/list
    http_status: 401
    body: '{"code":"mcp_unauthorized","message":"MCP authentication required.","data":{"status":401}}'
    www_authenticate: Bearer realm="https://www.dispatchhealth.com", resource_metadata="https://www.dispatchhealth.com/.well-known/oauth-protected-resource"
- name: mcp-adapter-default-server
  transport: http
  url: https://www.dispatchhealth.com/wp-json/mcp/mcp-adapter-default-server
  methods: [POST, GET, DELETE]
  auth: wordpress-session-or-application-password
  auth_gated: true
  probe:
    method: tools/list
    http_status: 401
    body: '{"code":"rest_forbidden","message":"Sorry, you are not allowed to do that.","data":{"status":401}}'
oauth:
  issuer: https://www.dispatchhealth.com
  authorization_endpoint: https://www.dispatchhealth.com/oauth/authorize
  token_endpoint: https://www.dispatchhealth.com/oauth/token
  revocation_endpoint: https://www.dispatchhealth.com/oauth/revoke
  grant_types: [authorization_code, refresh_token]
  code_challenge_methods: [S256]
  token_endpoint_auth_methods: [none]
  client_id_metadata_document_supported: true
  scopes: [mcp]
tools: []
tools_note: 'tools/list returns 401 on both servers, so the live tool set and its inputSchemas
  could NOT be enumerated anonymously. No tool list is asserted here — the WordPress
  Abilities API that backs these tools (/wp-json/wp-abilities/v1/abilities) is also
  401 (rest_forbidden). Re-run with an authenticated OAuth bearer to capture the real
  manifest.'
x-evidence:
  fetched: '2026-07-31'
  probes:
  - {url: 'https://www.dispatchhealth.com/wp-json/mcp/mcp-oauth-server', method: POST,
    jsonrpc_method: tools/list, http_status: 401}
  - {url: 'https://www.dispatchhealth.com/wp-json/mcp/mcp-oauth-server', method: POST,
    jsonrpc_method: initialize, http_status: 401}
  - {url: 'https://www.dispatchhealth.com/wp-json/mcp/mcp-adapter-default-server', method: POST,
    jsonrpc_method: tools/list, http_status: 401}
  - {url: 'https://www.dispatchhealth.com/wp-json/wp-abilities/v1/abilities', method: GET,
    http_status: 401}
notes: 'Surface caveat, recorded so it is not overstated: these MCP endpoints are exposed
  by the WordPress MCP adapter running on the dispatchhealth.com marketing site (WP
  Engine hosted, namespaces include mcp, wp-abilities/v1, wp/v2). They are a real,
  callable, first-party agent surface served from the provider''s own host — but they
  front the website''s content/abilities, not DispatchHealth''s clinical or partner
  platform (CESIA / Dispatch Express), which publishes no public API.'