generated: '2026-09-04'
method: probed
status: published
source: https://virtualincision.com/wp-json/mcp
server:
  name: mcp-oauth-server
  transport: http
  url: https://virtualincision.com/wp-json/mcp/mcp-oauth-server
  namespace_index: https://virtualincision.com/wp-json/mcp
  methods:
  - POST
  - GET
  - DELETE
  sibling_endpoint: https://virtualincision.com/wp-json/mcp/mcp-adapter-default-server
  implementation: WordPress MCP Adapter. The "mcp" namespace is registered in the virtualincision.com WordPress
    REST route index alongside wp-abilities/v1, which is the adapter's backing ability registry.
  first_party: true
  authorship: platform
  authorship_note: 'Platform-authored, not provider-authored: the tool surface is whatever the WordPress Abilities
    API registers, the same shape every WordPress MCP Adapter site serves. This is the site CMS''s MCP endpoint,
    not a MIRA product MCP server — Virtual Incision publishes no developer platform and advertises this endpoint
    nowhere in its documentation. It was found by enumerating https://virtualincision.com/wp-json/ and by the RFC
    9728 document at the domain root.'
authentication:
  gated: true
  observed: anonymous JSON-RPC tools/list on /wp-json/mcp/mcp-oauth-server -> HTTP 401 {"code":"mcp_unauthorized","message":"MCP
    authentication required.","data":{"status":401}}
  also_observed: anonymous JSON-RPC tools/list on /wp-json/mcp/mcp-adapter-default-server -> HTTP 401 rest_forbidden
  challenge: 'WWW-Authenticate: Bearer realm="https://virtualincision.com", resource_metadata="https://virtualincision.com/.well-known/oauth-protected-resource"'
  scheme: OAuth 2.1 authorization code + PKCE (S256), public client, dynamic client_id metadata document
  authorization_endpoint: https://virtualincision.com/oauth/authorize
  token_endpoint: https://virtualincision.com/oauth/token
  revocation_endpoint: https://virtualincision.com/oauth/revoke
  scopes_supported:
  - mcp
  oauth_discovery:
  - path: /.well-known/oauth-authorization-server
    status: 200
    file: well-known/virtual-incision-oauth-authorization-server.json
  - path: /.well-known/oauth-protected-resource
    status: 200
    file: well-known/virtual-incision-oauth-protected-resource.json
  endpoint_liveness:
  - url: https://virtualincision.com/oauth/token/
    status: 405
    body: '{"error":"invalid_request","error_description":"Method not allowed."}'
    note: A real OAuth error envelope on an unsupported method — the token endpoint exists.
  - url: https://virtualincision.com/oauth/authorize/
    status: 400
    note: HTML error page for a request with no client_id/redirect_uri — the authorize endpoint exists.
companion_surface:
  abilities_api: https://virtualincision.com/wp-json/wp-abilities/v1/abilities
  abilities_status: 401
  abilities_routes:
  - /wp-abilities/v1/abilities
  - /wp-abilities/v1/abilities/{name}
  - /wp-abilities/v1/abilities/{name}/run
  - /wp-abilities/v1/categories
  note: The WordPress Abilities API registry is what the MCP Adapter projects as tools. It is gated the same way,
    so the published tool set could not be enumerated anonymously.
tools: []
tools_note: NOT AN EMPTY TOOL SET — the tool set is unknown. tools/list is OAuth-gated on both endpoints, the wp-abilities
  registry is gated, and no llms.txt or documentation page lists tools, so there is no public source for tool names
  or input schemas. Nothing is derived or guessed here; authenticated introspection would be required to enumerate
  them.
x-evidence:
  fetched: '2026-09-04'
  url: https://virtualincision.com/wp-json/mcp/mcp-oauth-server
  http_status: 401
  content_type: application/json
  discovery_url: https://virtualincision.com/wp-json/
  namespace_index_status: 200
deployment:
  mode: remote
  endpoint: https://virtualincision.com/wp-json/mcp/mcp-oauth-server
  auth: oauth
  verified: probed
  probe: gated
  checked: '2026-09-04'