Renoolab Fr Authentication

generated: '2026-09-19'
method: searched
source: https://mcp.renoolab.fr/mcp
docs:
- https://renoolab.fr/mcp/
- https://github.com/mehdimicra/renoolab-mcp/blob/main/llms-install.md
- https://renoolab.fr/privacy/
sources:
- https://mcp.renoolab.fr/mcp (tools/list _meta.securitySchemes, 2026-09-19)
- https://mcp.renoolab.fr/.well-known/oauth-authorization-server
- https://mcp.renoolab.fr/.well-known/oauth-protected-resource
- https://renoolab.fr/.well-known/agent-card.json
summary:
  types: [none, oauth2]
  api_key_in: []
  oauth2_flows: [authorizationCode]
  bearer: true
  headline: >-
    Two tiers on one MCP endpoint. Reads (rechercher_artisans, rechercher_chantier) are anonymous - tools/list
    and the tools themselves declare {type: noauth} and the endpoint answered initialize/tools/list with no
    credential. Writes (contacter_artisan, creer_profil_artisan) require an OAuth 2.1 bearer token from the
    provider's own authorization server at https://mcp.renoolab.fr: authorization code + PKCE S256, dynamic
    client registration (RFC 7591), refresh tokens, revocation, token endpoint auth incl. `none` for public
    clients, bearer in the Authorization header (RFC 9728 bearer_methods_supported). No RenooLab account is
    required to complete the consent, no API keys exist, and the install guide instructs clients to add NO
    headers, keys, client_id or secret to the configuration. The A2A agent is read-only and anonymous (no
    securitySchemes in the card). The WebMCP in-page tools run in the user's browser session against the
    site's own Worker; the two write tools there require a visible human confirmation in the page.
schemes:
- name: noauth
  type: none
  applies_to: [rechercher_artisans, rechercher_chantier, 'A2A https://a2a.renoolab.fr/a2a', 'MCP initialize / tools/list / resources/list']
  description: Anonymous access; the server applies per-actor quotas (see rate-limits/renoolab-fr-rate-limits.yml) using pseudonymous actor ids and an HMAC of the IP (privacy policy §2).
  sources: [mcp/renoolab-fr-mcp-tools-list.json]
- name: RenooLabOAuth
  type: oauth2
  applies_to: [contacter_artisan, creer_profil_artisan]
  issuer: https://mcp.renoolab.fr
  flows:
  - flow: authorizationCode
    authorizationUrl: https://mcp.renoolab.fr/authorize
    tokenUrl: https://mcp.renoolab.fr/token
    refreshUrl: https://mcp.renoolab.fr/token
    pkce: S256
    scopes: {}
  dynamic_client_registration: https://mcp.renoolab.fr/register
  revocation_endpoint: https://mcp.renoolab.fr/token
  token_endpoint_auth_methods: [client_secret_basic, client_secret_post, none]
  bearer_methods: [header]
  protected_resource_metadata: well-known/renoolab-fr-oauth-protected-resource.json
  authorization_server_metadata: well-known/renoolab-fr-oauth-authorization-server.json
  account_required: false
  consent: all four tools in one grant (docs); the two read tools do not actually require the token
  token_lifetimes: {access_token: 1 hour, refresh_token: 30 days, dynamic_client: 90 days, consent_session: 10 minutes, source: 'https://renoolab.fr/privacy/ §5'}
  consent_cookies: 'two strictly-necessary HttpOnly cookies during consent: a 10-minute anti-CSRF token and a 12-month pseudonymous browser id used to manage and revoke OAuth grants (privacy policy §7)'
  sources: [mcp/renoolab-fr-mcp-tools-list.json, well-known/renoolab-fr-oauth-authorization-server.json]
observed:
- {request: 'POST /mcp tools/list without credentials', result: 200 - full tool list}
- {request: 'GET /mcp', result: 406 application/json (Accept negotiation, not auth)}
- {request: 'GET /register', result: 405}
- {request: 'GET /authorize', result: 400}
- {request: 'GET /mcp/index.md on the MCP host', result: 401 application/json}
not_used: [apiKey, http basic, openIdConnect, mutualTLS]