generated: '2026-08-04'
method: searched
status: published
source: https://api.meshpayments.com/.well-known/oauth-protected-resource
server:
  name: mesh-payments
  transport: http
  url: https://api.meshpayments.com/mcp
  protocol: Model Context Protocol (JSON-RPC over HTTP)
discovery:
  protected_resource_metadata: https://api.meshpayments.com/.well-known/oauth-protected-resource/mcp
  spec: RFC 9728 OAuth 2.0 Protected Resource Metadata
  authorization_servers:
  - https://api.meshpayments.com
  bearer_methods_supported:
  - header
  resource_signing_alg_values_supported:
  - RS256
authentication:
  gated: true
  scheme: OAuth 2.0 Bearer
  challenge: 'WWW-Authenticate: Bearer resource_metadata="https://api.meshpayments.com/.well-known/oauth-protected-resource/mcp"'
  authorization_server: https://api.meshpayments.com
  grant_types_supported:
  - authorization_code
  - client_credentials
  - refresh_token
  - urn:ietf:params:oauth:grant-type:device_code
  - urn:ietf:params:oauth:grant-type:token-exchange
  dynamic_client_registration: https://api.meshpayments.com/as/register
tools: []
tools_note: tools/list and initialize both return HTTP 401 without a bearer token,
  so the live tool manifest and per-tool inputSchema require authenticated introspection
  with Mesh-issued OAuth credentials. No tool list is published anonymously (the developers
  portal that would document it is itself behind HTTP Basic auth), so none is recorded
  here rather than guessed.
provider_statements:
- source: https://meshpayments.com/orchestration/
  quote: MCP-compatible. Connect your own AI agents. Build custom workflows on top
    of Mesh's orchestration layer.
x-evidence:
- fetched: '2026-08-04'
  url: https://api.meshpayments.com/.well-known/oauth-protected-resource
  http_status: 200
  content_type: application/json
- fetched: '2026-08-04'
  url: https://api.meshpayments.com/.well-known/oauth-protected-resource/mcp
  http_status: 200
  content_type: application/json
- fetched: '2026-08-04'
  url: https://api.meshpayments.com/mcp
  method: POST tools/list
  http_status: 401
  note: WWW-Authenticate Bearer challenge, confirming a live OAuth-protected MCP resource
- fetched: '2026-08-04'
  url: https://api.meshpayments.com/as/jwks
  http_status: 200
  note: publishes a signing key with kid "mcp-signing-key"