generated: '2026-08-05'
method: searched
source: https://api.serviceup.com/mcp
status: published
discovery:
  how: >-
    Found by direct probe of the API host root. ServiceUp does not document this
    endpoint anywhere on its public site, does not list it in the Model Context
    Protocol registry, and returns HTTP 404 for every other path probed on
    api.serviceup.com. The 401 (rather than 404) at /mcp, together with a
    conformant RFC 9728 WWW-Authenticate challenge, is what confirms it.
  registry_listed: false
  documented_publicly: false
server:
  name: serviceup
  transport: http
  protocol: streamable-http
  url: https://api.serviceup.com/mcp
  methods_allowed:
  - GET
  - POST
  - DELETE
  - OPTIONS
  session_header: mcp-session-id
  cors:
    allow_origin: '*'
    allow_headers:
    - Content-Type
    - Authorization
    - mcp-session-id
authentication:
  required: true
  scheme: Bearer
  model: OAuth 2.1 authorization code + PKCE (S256)
  authorization_server: https://auth.serviceup.com
  resource_metadata: https://api.serviceup.com/.well-known/oauth-protected-resource/mcp
  scopes:
  - mcp:read
  - mcp:write
  challenge: >-
    WWW-Authenticate: Bearer resource_metadata="https://api.serviceup.com/.well-known/oauth-protected-resource/mcp",
    error="invalid_token", error_description="Missing or invalid Authorization header"
  profile: authentication/serviceup-authentication.yml
  scopes_artifact: scopes/serviceup-scopes.yml
tools: []
tools_status: gated
tools_note: >-
  tools/list is OAuth-gated — an anonymous JSON-RPC tools/list POST returns HTTP 401
  with {"error":"Missing or invalid Authorization header"}. The real tool set and its
  inputSchemas require an authenticated introspection with an mcp:read token, which
  ServiceUp issues only to its own customers (no dynamic client registration endpoint
  is advertised). No tool list is recorded here because none could be observed, and
  ServiceUp publishes no llms.txt or docs page naming its tools. NOTHING IS INFERRED.
infrastructure:
  server_header: Google Frontend
  framework_fingerprint: Express (x-powered-by), NestJS-shaped error envelope
  note: Fingerprint observed from response headers and error bodies only.
x-evidence:
- url: https://api.serviceup.com/mcp
  method: GET
  http_status: 401
  content_type: application/json
  fetched: '2026-08-05'
- url: https://api.serviceup.com/mcp
  method: POST
  body: '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
  http_status: 401
  content_type: application/json
  fetched: '2026-08-05'
- url: https://api.serviceup.com/.well-known/oauth-protected-resource/mcp
  method: GET
  http_status: 200
  fetched: '2026-08-05'
- url: https://registry.modelcontextprotocol.io/v0/servers?search=serviceup
  method: GET
  http_status: 200
  result: 'servers: [], count: 0'
  fetched: '2026-08-05'