tl;dv OAuth Scopes

generated: '2026-08-14'
method: probed
source: https://mcp.tldv.io/.well-known/oauth-protected-resource
note: >
  The tl;dv REST API has NO OAuth surface — it authenticates with a single
  x-api-key header and has no scopes (see
  authentication/tl-dv-authentication.yml). A prior round therefore omitted
  this artifact, correctly at the time.

  An OAuth scope surface does exist, but only on the hosted MCP endpoint
  https://mcp.tldv.io/mcp, and it was found by probe rather than in any
  documentation. The RFC 9728 protected-resource metadata and the RFC 8414
  authorization-server metadata both resolve 200 anonymously and are saved
  verbatim under well-known/. Exactly ONE scope is advertised. tl;dv publishes
  no scopes/permissions reference page, so descriptions below are read from the
  metadata and the server's capability, not from prose that does not exist.
applies_to: mcp
docs: null
docs_note: No published OAuth scope or permissions reference page was found.
resource:
  identifier: https://mcp.tldv.io/
  name: MCP Demo Server
  metadata_file: well-known/tl-dv-oauth-protected-resource.json
schemes:
  - name: MCPOAuth
    type: oauth2
    source: https://mcp.tldv.io/.well-known/oauth-authorization-server
    metadata_file: well-known/tl-dv-oauth-authorization-server.json
    issuer: https://keycloak.tldv.io/realms/mcp.tldv.io
    implementation: Keycloak
    flows:
      - flow: authorizationCode
        authorizationUrl: https://keycloak.tldv.io/realms/mcp.tldv.io/protocol/openid-connect/auth
        tokenUrl: https://keycloak.tldv.io/realms/mcp.tldv.io/protocol/openid-connect/token
        refreshUrl: https://keycloak.tldv.io/realms/mcp.tldv.io/protocol/openid-connect/token
    grant_types_supported: [authorization_code, refresh_token]
    response_types_supported:
      - code
      - none
      - id_token
      - token
      - id_token token
      - code id_token
      - code token
      - code id_token token
    code_challenge_methods_supported: [S256]
    token_endpoint_auth_methods_supported: [client_secret_basic, client_secret_post, none]
    registration_endpoint: https://keycloak.tldv.io/realms/mcp.tldv.io/clients-registrations/openid-connect
    introspection_endpoint: https://keycloak.tldv.io/realms/mcp.tldv.io/protocol/openid-connect/token/introspect
    revocation_endpoint: https://keycloak.tldv.io/realms/mcp.tldv.io/protocol/openid-connect/revoke
    dynamic_client_registration: true
    pkce_required: true
scopes:
  - scope: mcp:tools
    description: >-
      Invoke the tools exposed by the tl;dv MCP server (list-meetings,
      get-meeting-metadata, get-transcript, get-highlights).
    flows: [authorizationCode]
    sources: [well-known/tl-dv-oauth-protected-resource.json]
    granularity: coarse
    note: >
      A single all-or-nothing scope covering every tool. There is no read/write
      split and no per-resource scoping, so a token that can list meetings can
      also pull full transcripts of them. Worth noting for agent delegation:
      least-privilege is not expressible on this surface.
summary:
  scope_count: 1
  oauth2_flows: [authorizationCode]
  pkce: S256
  dynamic_client_registration: true
x-evidence:
  - url: https://mcp.tldv.io/.well-known/oauth-protected-resource
    http_status: 200
    fetched: '2026-08-14'
  - url: https://mcp.tldv.io/.well-known/oauth-authorization-server
    http_status: 200
    fetched: '2026-08-14'
  - url: https://mcp.tldv.io/mcp
    http_status: 401
    fetched: '2026-08-14'
    note: WWW-Authenticate Bearer challenge naming the resource_metadata document.