CharacterQuilt · OAuth Scopes

CharacterQuilt OAuth Scopes

OAuth 2.0 probed

CharacterQuilt uses OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (e.g. client-credentials or role-based authorization) rather than per-scope consent.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

CompanyMarketingArtificial IntelligenceAI AgentsMarketing AutomationCampaign ManagementBrand IdentityComputer Use AgentsY CombinatorDataMCP
Scopes: 0 Flows: Method: probed

Scopes (0)

CharacterQuilt implements OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (client-credentials or role-based authorization) rather than per-scope consent.

Scopes read verbatim from CharacterQuilt's own RFC 9728 OAuth Protected Resource Metadata document, served at the MCP host and returned HTTP 200 with content-type application/json. CharacterQuilt publishes no scope reference page, so the descriptions below are read from the scope names themselves and are marked as such — nothing here is invented beyond naming what a read:/write:/publish: verb on a named resource means. The scopes are NOT declared in any OpenAPI securityScheme; the protected-resource metadata is the only place they appear.

📄 Provider scope reference:

Source

OAuth Scopes

Raw ↑ 
generated: '2026-08-13'
method: probed
source: https://mcp.characterquilt.com/.well-known/oauth-protected-resource
docs: null
note: >-
  Scopes read verbatim from CharacterQuilt's own RFC 9728 OAuth Protected Resource
  Metadata document, served at the MCP host and returned HTTP 200 with
  content-type application/json. CharacterQuilt publishes no scope reference page,
  so the descriptions below are read from the scope names themselves and are marked
  as such — nothing here is invented beyond naming what a read:/write:/publish: verb
  on a named resource means. The scopes are NOT declared in any OpenAPI
  securityScheme; the protected-resource metadata is the only place they appear.
x-evidence:
  fetched: '2026-08-13'
  url: https://mcp.characterquilt.com/.well-known/oauth-protected-resource
  http_status: 200
  content_type: application/json
  raw_file: well-known/characterquilt-oauth-protected-resource.json
resource: https://mcp.characterquilt.com/api/mcp
authorization_servers:
- https://characterquilt-review-beta.vercel.app
bearer_methods_supported:
- header
scope_count: 5
scopes:
- name: read:design_brain
  access: read
  resource: design_brain
  description: >-
    Read access to the "design brain" — CharacterQuilt's per-customer brand model
    (the brand/creative knowledge its Design Agent operates from). Scope name is
    published; CharacterQuilt documents no per-scope reference.
- name: write:generated_artifacts
  access: write
  resource: generated_artifacts
  description: >-
    Write access to generated artifacts — the creative output the agents produce
    (emails, ads, landing pages, one-pagers, decks).
- name: publish:public_file
  access: publish
  resource: public_file
  description: >-
    Publish a file to a public location. The only scope whose verb is neither read
    nor write, and the one with an externally visible consequence.
- name: read:agent_work
  access: read
  resource: agent_work
  description: Read access to agent work — the runs/tasks the agents execute.
- name: write:agent_work
  access: write
  resource: agent_work
  description: Write access to agent work — creating or modifying agent runs/tasks.
gaps:
- issue: no-scope-reference-page
  detail: >-
    No public documentation maps these scopes to operations, so a client cannot
    determine least privilege for a given task. The scope strings are only
    discoverable by reading the protected-resource metadata.
- issue: authorization-server-metadata-missing
  detail: >-
    authorization_servers names https://characterquilt-review-beta.vercel.app — a
    Vercel preview deployment — and that host does NOT serve RFC 8414
    authorization-server metadata: both /.well-known/oauth-authorization-server and
    /.well-known/openid-configuration return HTTP 200 with the Next.js HTML app
    shell, not JSON. The OAuth discovery chain therefore terminates: an MCP client
    that follows the WWW-Authenticate resource_metadata pointer correctly cannot
    reach an authorization endpoint. Probed 2026-08-13.