Wyndham Business WordPress MCP Server (OAuth-gated)
A WordPress MCP adapter is registered on www.wyndhambusiness.com in the `mcp` namespace alongside wp-abilities/v1, and — unlike most WordPress MCP installs — it is bound to a working OAuth 2.1 authorization server. /.well-known/oauth-authorization-server (RFC 8414) and /.well-known/oauth-protected-resource (RFC 9728) both return HTTP 200 anonymously; the protected resource names the MCP endpoint explicitly, PKCE S256 is the only code-challenge method, the token endpoint accepts no client authentication, client_id_metadata_document_supported is true, and the single advertised scope is `mcp`. An anonymous JSON-RPC tools/list returns 401 mcp_unauthorized with a correct WWW-Authenticate bearer challenge carrying resource_metadata. The surface genuinely exists and is genuinely not publicly usable — no tool names, descriptions or input schemas can be read without a credential Wyndham issues to no third party, and no registration endpoint is published. Recorded as a gated surface rather than a product.