generated: '2026-08-25'
method: probed
status: published
source: https://mylocalinfusion.com/wp-json/mcp
summary: >-
  Local Infusion's corporate WordPress site exposes two live Model Context Protocol servers under the
  `mcp` REST namespace, guarded by an OAuth 2.1 authorization server the same host advertises via RFC
  8414 and RFC 9728 metadata. This is a site-CMS MCP surface produced by the WordPress MCP adapter,
  not a clinical, patient-scheduling or claims server — Local Infusion is an outpatient infusion
  therapy provider and publishes no developer product API. Both servers were probed anonymously on
  2026-08-25 and both returned HTTP 401, so the live tool set could not be enumerated. No tool list is
  recorded below because none was observed; nothing is inferred.
servers:
- name: mcp-oauth-server
  transport: http
  url: https://mylocalinfusion.com/wp-json/mcp/mcp-oauth-server
  methods:
  - POST
  - GET
  - DELETE
  auth:
    type: oauth2
    scheme: Bearer
    scopes:
    - mcp
    authorization_server: https://mylocalinfusion.com
    protected_resource_metadata: https://mylocalinfusion.com/.well-known/oauth-protected-resource
    authorization_endpoint: https://mylocalinfusion.com/oauth/authorize
    token_endpoint: https://mylocalinfusion.com/oauth/token
    revocation_endpoint: https://mylocalinfusion.com/oauth/revoke
    pkce: S256
    client_registration: client_id_metadata_document
  probe:
    method: POST
    body: '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
    http_status: 401
    body_observed: '{"code":"mcp_unauthorized","message":"MCP authentication required.","data":{"status":401}}'
    www_authenticate: >-
      Bearer realm="https://mylocalinfusion.com",
      resource_metadata="https://mylocalinfusion.com/.well-known/oauth-protected-resource"
    note: >-
      Correct RFC 9728 challenge behaviour — the 401 names the protected-resource metadata document.
      An `initialize` call returns the identical challenge. The live tool set requires an authenticated
      tools/list; it is not published anonymously.
- name: mcp-adapter-default-server
  transport: http
  url: https://mylocalinfusion.com/wp-json/mcp/mcp-adapter-default-server
  methods:
  - POST
  - GET
  - DELETE
  auth:
    type: wordpress-capability
    note: Gated by WordPress capability checks rather than the OAuth challenge.
  probe:
    method: POST
    body: '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
    http_status: 401
    body_observed: '{"code":"rest_forbidden","message":"Sorry, you are not allowed to do that.","data":{"status":401}}'
tools: []
tools_note: >-
  Empty by design. tools/list is auth-gated on both servers, and the WordPress Abilities API registry
  (/wp-json/wp-abilities/v1/abilities) — the surface the MCP adapter projects into tools — also
  returned HTTP 401 anonymously. The site's own /llms.txt is a content/GEO document and lists no
  tools, so there is no published tool list to fall back to. Deriving a speculative tool list from the
  REST surface would misrepresent what these servers expose.
related:
  abilities_registry:
    url: https://mylocalinfusion.com/wp-json/wp-abilities/v1/abilities
    http_status: 401
    note: >-
      WordPress Abilities API (wp-abilities/v1) — the named-ability registry the MCP adapter binds
      tools to. Routes are advertised in the public discovery document but read access is gated.
  agent_discovery:
    note: >-
      The same host publishes /llms.txt, /llms-full.txt, /.well-known/ai-manifest.json,
      /.well-known/brand-facts.json and /.well-known/llm-sitemap.json — a content-layer agent posture
      aimed at answer engines, distinct from and much more developed than this tool layer.
x-evidence:
  fetched: '2026-08-25'
  namespace_discovery:
    url: https://mylocalinfusion.com/wp-json/mcp
    http_status: 200
    content_type: application/json
  routes_observed:
  - /mcp
  - /mcp/mcp-oauth-server
  - /mcp/mcp-adapter-default-server
deployment:
  mode: remote
  endpoint: https://mylocalinfusion.com/wp-json/mcp/mcp-oauth-server
  auth: oauth
  verified: probed
  probe: gated
  checked: '2026-08-25'
  source: anonymous POST tools/list, HTTP 401 with RFC 9728 Bearer challenge
  note: >-
    No stdio distribution. Nothing first-party exists on npm or PyPI; the server is the WordPress MCP
    adapter running in-process on the provider's own web host, reachable only as an HTTPS endpoint.