generated: '2026-08-23'
method: probed
source: https://www.jellyvision.com/.well-known/oauth-protected-resource
status: published
summary: >-
  Jellyvision serves a live, OAuth-protected Model Context Protocol server from its own marketing
  host. It was found by following RFC 9728 protected-resource metadata at
  https://www.jellyvision.com/.well-known/oauth-protected-resource, which names the resource
  https://www.jellyvision.com/wp-json/mcp/mcp-oauth-server and the authorization server
  https://www.jellyvision.com, and it was confirmed live by POSTing MCP JSON-RPC to that endpoint.
scope_warning: >-
  This is a CONTENT MCP server on the WordPress marketing site, not an ALEX product API server. It
  is served from the /wp-json/ REST namespace of www.jellyvision.com and its OAuth server advertises
  only the "mcp" scope with dynamic client registration. Nothing observed connects it to the ALEX
  Partner Integration API, whose surface lives on myalex.com behind separate Auth0 client-credentials
  tenants. Do not read this as agent access to ALEX benefits data.
deployment:
  mode: remote
  endpoint: https://www.jellyvision.com/wp-json/mcp/mcp-oauth-server
  auth: oauth
  verified: probed
transport:
  protocol: MCP over HTTP JSON-RPC
  methods_allowed: [POST, GET, DELETE]
  allow_header_observed: 'POST, GET, DELETE'
authorization:
  spec: RFC 9728 OAuth 2.0 Protected Resource Metadata
  compliant: true
  www_authenticate: 'Bearer realm="https://www.jellyvision.com", resource_metadata="https://www.jellyvision.com/.well-known/oauth-protected-resource"'
  protected_resource_metadata: https://www.jellyvision.com/.well-known/oauth-protected-resource
  authorization_server_metadata: https://www.jellyvision.com/.well-known/oauth-authorization-server
  authorization_endpoint: https://www.jellyvision.com/oauth/authorize
  token_endpoint: https://www.jellyvision.com/oauth/token
  revocation_endpoint: https://www.jellyvision.com/oauth/revoke
  grant_types_supported: [authorization_code, refresh_token]
  code_challenge_methods_supported: [S256]
  token_endpoint_auth_methods_supported: [none]
  dynamic_client_registration: client_id_metadata_document
  scopes_supported: [mcp]
  bearer_methods_supported: [header]
tools:
  discovered: false
  count: null
  reason: >-
    tools/list is auth-gated. An anonymous JSON-RPC POST of both initialize and tools/list returned
    HTTP 401 with body {"code":"mcp_unauthorized","message":"MCP authentication required."}. The
    real tool set and per-tool inputSchema require an OAuth token obtained through the advertised
    authorization-code + PKCE flow, so no tool list is recorded here rather than guessed.
  fallback_attempted: >-
    The provider's llms.txt (https://www.jellyvision.com/llms.txt, HTTP 200) was checked as a
    fallback tool source. It is a Yoast SEO-generated content index of pages, posts, categories and
    resource types — it lists no MCP tools, so no name/description fallback was available either.
probes:
- url: https://www.jellyvision.com/.well-known/oauth-protected-resource
  method: GET
  status: 200
  result: RFC 9728 metadata naming the MCP resource
- url: https://www.jellyvision.com/.well-known/oauth-authorization-server
  method: GET
  status: 200
  result: RFC 8414 metadata, scopes_supported ["mcp"]
- url: https://www.jellyvision.com/wp-json/mcp/mcp-oauth-server
  method: POST
  body: '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
  status: 401
  result: mcp_unauthorized — server is live and gated
- url: https://www.jellyvision.com/wp-json/mcp/mcp-oauth-server
  method: POST
  body: initialize (protocolVersion 2025-06-18)
  status: 401
  result: mcp_unauthorized
implementation_notes: >-
  Served from WordPress on WP Engine behind Cloudflare (x-powered-by: WP Engine, server: cloudflare),
  under the /wp-json/mcp/ REST namespace and marked x-robots-tag: noindex. The site's llms.txt is
  generated by Yoast SEO v28.2, consistent with an SEO-plugin-provided MCP surface rather than a
  bespoke product server.