generated: '2026-08-26'
method: probed
source: https://www.reedsemi.com/.well-known/oauth-authorization-server
name: Reed Semiconductor OAuth Scopes
description: >-
  Scope surface read directly from the RFC 8414 authorization-server metadata and the
  RFC 9728 protected-resource metadata served at www.reedsemi.com. The deployment
  declares exactly one scope. There is no published scopes/permissions reference page
  — Reed operates no developer portal — so the metadata documents are the only source.
issuer: https://www.reedsemi.com
docs: null
docs_note: >-
  No scopes or permissions reference is published. Reed Semiconductor runs no developer
  documentation site; the OAuth surface exists only as plugin-emitted metadata.
authorization_endpoint: https://www.reedsemi.com/wp-admin/admin.php?page=novamira-oauth-authorize
token_endpoint: https://www.reedsemi.com/wp-json/novamira/v1/oauth/token
flows:
- type: authorization_code
  pkce: required
  code_challenge_methods:
  - S256
- type: refresh_token
- type: device_code
  grant: 'urn:ietf:params:oauth:grant-type:device_code'
  device_authorization_endpoint: https://www.reedsemi.com/wp-json/novamira/v1/oauth/device
token_endpoint_auth_methods:
- none
dynamic_client_registration:
  supported: true
  endpoint: https://www.reedsemi.com/wp-json/novamira/v1/oauth/register
  note: RFC 7591 dynamic client registration is open — no pre-registration required.
scope_count: 1
scopes:
- name: mcp
  description: >-
    The only scope the authorization server advertises. Grants access to the Model
    Context Protocol server at /wp-json/mcp/novamira-oauth and to the WordPress
    Abilities API at /wp-json/wp-abilities/v1/*, both of which return
    rest_oauth_required without it.
  resources:
  - https://www.reedsemi.com/wp-json/mcp/novamira-oauth
  - https://www.reedsemi.com/wp-json/wp-abilities/v1/abilities
  source: '.well-known/oauth-authorization-server -> scopes_supported'
findings:
  granularity: coarse
  note: >-
    A single undifferentiated scope covers the whole agent surface. Because the tool
    list is gated, a client cannot tell before authorizing what capabilities "mcp"
    actually confers — there is no read/write split and no per-tool scope.
x-evidence:
  fetched: '2026-08-26'
  probes:
  - url: https://www.reedsemi.com/.well-known/oauth-authorization-server
    status: 200
  - url: https://www.reedsemi.com/.well-known/oauth-protected-resource
    status: 200