Wyndham Business WordPress MCP Server (OAuth-gated)

A WordPress MCP adapter is registered on www.wyndhambusiness.com in the `mcp` namespace alongside wp-abilities/v1, and — unlike most WordPress MCP installs — it is bound to a working OAuth 2.1 authorization server. /.well-known/oauth-authorization-server (RFC 8414) and /.well-known/oauth-protected-resource (RFC 9728) both return HTTP 200 anonymously; the protected resource names the MCP endpoint explicitly, PKCE S256 is the only code-challenge method, the token endpoint accepts no client authentication, client_id_metadata_document_supported is true, and the single advertised scope is `mcp`. An anonymous JSON-RPC tools/list returns 401 mcp_unauthorized with a correct WWW-Authenticate bearer challenge carrying resource_metadata. The surface genuinely exists and is genuinely not publicly usable — no tool names, descriptions or input schemas can be read without a credential Wyndham issues to no third party, and no registration endpoint is published. Recorded as a gated surface rather than a product.

API entry from apis.yml

apis.yml Raw ↑
aid: wyndham-hotels:wyndham-business-mcp-server
name: Wyndham Business WordPress MCP Server (OAuth-gated)
description: A WordPress MCP adapter is registered on www.wyndhambusiness.com in the `mcp` namespace alongside
  wp-abilities/v1, and — unlike most WordPress MCP installs — it is bound to a working OAuth 2.1 authorization
  server. /.well-known/oauth-authorization-server (RFC 8414) and /.well-known/oauth-protected-resource
  (RFC 9728) both return HTTP 200 anonymously; the protected resource names the MCP endpoint explicitly,
  PKCE S256 is the only code-challenge method, the token endpoint accepts no client authentication, client_id_metadata_document_supported
  is true, and the single advertised scope is `mcp`. An anonymous JSON-RPC tools/list returns 401 mcp_unauthorized
  with a correct WWW-Authenticate bearer challenge carrying resource_metadata. The surface genuinely exists
  and is genuinely not publicly usable — no tool names, descriptions or input schemas can be read without
  a credential Wyndham issues to no third party, and no registration endpoint is published. Recorded as
  a gated surface rather than a product.
humanURL: https://www.wyndhambusiness.com/wp-json/mcp
baseURL: https://www.wyndhambusiness.com/wp-json/mcp/mcp-oauth-server
tags:
- MCP
- Agents
- WordPress
- OAuth
- Gated
properties:
- type: MCPServer
  url: mcp/wyndham-hotels-mcp.yml
- type: Discovery
  url: https://www.wyndhambusiness.com/wp-json/mcp
- type: Authentication
  url: authentication/wyndham-hotels-authentication.yml
- type: OAuthScopes
  url: scopes/wyndham-hotels-scopes.yml
- type: WellKnown
  url: well-known/wyndham-hotels-well-known.yml