generated: '2026-08-17'
method: probed
status: published
source: https://heuritech.com/.well-known/oauth-protected-resource
description: >-
  Heuritech serves a live remote Model Context Protocol server on its primary marketing host. It is
  advertised nowhere in Heuritech's documentation and appears in no MCP registry — it was found by
  probing /.well-known/* on heuritech.com, which returns both RFC 8414 authorization-server metadata
  and RFC 9728 protected-resource metadata, and confirmed by enumerating the `mcp` namespace in the
  WordPress REST route index at https://heuritech.com/wp-json/. The server fronts the Heuritech
  WordPress content estate (marketing site and blog), NOT the commercial Heuritech trend data API.
server:
  name: mcp-oauth-server
  transport: http
  url: https://heuritech.com/wp-json/mcp/mcp-oauth-server
  namespace_index: https://heuritech.com/wp-json/mcp
  protocol: MCP over HTTP (JSON-RPC 2.0)
  methods:
  - POST
  - GET
  - DELETE
  implementation: >-
    WordPress REST namespace `mcp` on the heuritech.com WordPress.com Atomic site, alongside the
    wp-abilities/v1 ability registry the MCP adapter projects as tools. Two routes are registered:
    mcp/mcp-oauth-server (OAuth-protected) and mcp/mcp-adapter-default-server (cookie/application-password
    protected).
  first_party: true
  first_party_note: >-
    Served from heuritech.com, a domain Heuritech owns, but generated by the hosting platform rather
    than authored by Heuritech. Recorded as present because it is live and callable, and qualified
    here so no reader mistakes it for a Heuritech product API.
alternate_endpoints:
- url: https://heuritech.com/wp-json/mcp/mcp-adapter-default-server
  status: 401
  auth: WordPress Application Passwords (HTTP Basic) / logged-in cookie + X-WP-Nonce
  response: '{"code":"rest_forbidden","message":"Sorry, you are not allowed to do that.","data":{"status":401}}'
authorization:
  required: true
  model: OAuth 2.1 authorization code with PKCE
  authorization_servers:
  - https://heuritech.com
  issuer: https://heuritech.com
  authorization_endpoint: https://heuritech.com/oauth/authorize
  token_endpoint: https://heuritech.com/oauth/token
  revocation_endpoint: https://heuritech.com/oauth/revoke
  grant_types_supported:
  - authorization_code
  - refresh_token
  response_types_supported:
  - code
  code_challenge_methods_supported:
  - S256
  token_endpoint_auth_methods_supported:
  - none
  client_id_metadata_document_supported: true
  bearer_methods_supported:
  - header
  scopes_supported:
  - mcp
  www_authenticate: >-
    Bearer realm="https://heuritech.com",
    resource_metadata="https://heuritech.com/.well-known/oauth-protected-resource"
  rfc9728_compliant: true
  detail: scopes/heuritech-scopes.yml
tools:
  discovered: false
  discovery_method: 'POST {"jsonrpc":"2.0","id":1,"method":"tools/list"} with Accept: application/json,
    text/event-stream'
  http_status: 401
  response: '{"code":"mcp_unauthorized","message":"MCP authentication required.","data":{"status":401}}'
  note: >-
    The live tool list and per-tool inputSchema are auth-gated. Heuritech publishes no tool inventory in
    its documentation, has no llms.txt, and the backing wp-abilities/v1 registry is gated the same way, so
    NO tool list is recorded here — deriving one would be fabrication. Authenticated introspection is
    required to enumerate the surface.
companion_surface:
  abilities_api: https://heuritech.com/wp-json/wp-abilities/v1/abilities
  abilities_routes:
  - /wp-abilities/v1/abilities
  - /wp-abilities/v1/abilities/{name}
  - /wp-abilities/v1/abilities/{name}/run
  - /wp-abilities/v1/categories
  note: >-
    The WordPress Abilities API registry is what the MCP adapter projects as tools; it is registered in
    the heuritech.com route index and gated the same way.
related_surfaces:
  openapi: openapi/heuritech-posts-api-openapi.yml
  note: >-
    The MCP server and the derived REST content specs project the same WordPress data core, but the tool
    names are unobservable so the binding cannot be made. See mcp/heuritech-tool-crosswalk.yml. The
    commercial Heuritech trend data API is a third, entirely separate and sales-gated surface with no
    MCP or REST representation in public.
x-evidence:
  fetched: '2026-08-17'
  probes:
  - url: https://heuritech.com/.well-known/oauth-protected-resource/
    status: 200
    content_type: application/json
  - url: https://heuritech.com/.well-known/oauth-authorization-server/
    status: 200
    content_type: application/json
  - url: https://heuritech.com/wp-json/mcp/mcp-oauth-server
    method: POST tools/list
    status: 401
  - url: https://heuritech.com/wp-json/mcp/mcp-adapter-default-server
    method: POST tools/list
    status: 401
  - url: https://heuritech.com/wp-json/mcp
    status: 200
deployment:
  mode: remote
  endpoint: https://heuritech.com/wp-json/mcp/mcp-oauth-server
  auth: oauth
  verified: probed
  probe: gated
  checked: '2026-08-17'