# Web AI clients that can use a self-hosted JUJU server Research date: **2026-09-09**. Method: one researcher agent per product read official documentation (help centers, developer docs, changelogs; vendor blogs and third-party guides only as secondary evidence), then an independent adversarial verifier re-fetched every cited page and corrected or downgraded claims; a final architect agent merged the records. 15 agents, 784 web/tool calls. Anything the verifier could not confirm from a fetched page is listed under "Unverified claims" and must not be treated as fact. Vendors change these UIs often — re-check the linked sources before relying on a detail. JUJU profile the products were evaluated against: MCP Streamable HTTP at `https:///mcp`; OAuth 2.1 authorization-code + PKCE S256 with an embedded authorization server on the same origin (RFC 8414 + RFC 9728 discovery, `WWW-Authenticate` on 401, resource indicators); **static client registration only** (`juju auth add-client --redirect-uri `), no RFC 7591 dynamic client registration; owner consent on the terminal (`juju auth pending` → `juju auth approve `). > Update after the research run: JUJU now advertises RFC 9207 > (`authorization_response_iss_parameter_supported: true`, commit 4fe2d2d; > `iss` was already sent on every authorization response). Rows that say "JUJU > lacks RFC 9207" were written before that change. Whether ChatGPT then uses its > stable callback has **not** been verified against ChatGPT itself — register > both ChatGPT callbacks until it is. > **JUJU 0.7.1 update:** the HTTP surface ChatGPT sees is now COMPACT — > 19 tools (gateways + juju_discover) instead of 74, ~47 KB of tool > definitions instead of ~236 KB, same capabilities and identical > authorization. If a connector previously failed to ingest the 0.7.0 > catalog, rescan the app after upgrading. STDIO clients still get the full > per-tool catalog. ## Summary JUJU (Streamable HTTP at https:///mcp; OAuth 2.1 auth-code + PKCE S256 with a same-origin embedded AS; RFC 8414/9728 discovery; static pre-registered clients only, no RFC 7591 DCR; terminal-approved consent) can be added TODAY, with caveats, to the five major web chat products in scope — ChatGPT web (developer-mode plugin, paid plans, per-connection callback URL because JUJU lacks RFC 9207), Claude.ai web/desktop (custom connector, all plans incl. Free, fixed callback, official 'Use your own OAuth client'), Gemini web app (only inside Gemini Spark for AI Pro-US/Ultra subscribers, confidential client, callback copied from dialog), Mistral Le Chat/Vibe (admin-only, static path evidenced only by third-party guides, production callback unofficial), Perplexity web/desktop (Pro/Max/Enterprise, fixed callback, PKCE S256 observed) — plus Microsoft 365 Copilot declarative agents and Copilot Studio (work/school tenants only; consumer Copilot has no MCP), and to Grok, Cursor Cloud Agents, Devin, Slackbot, Amazon Quick and Glean. It is blocked on DCR-only clients (Notion Custom Agents, Replit Agent), has no OAuth path on HuggingChat/Cohere North/Manus, and is unknown on Zapier, Make and Salesforce Agentforce. No product requires DCR among the big five; every product drives a browser redirect, so JUJU's /authorize page must render immediately, poll until `juju auth approve`, then 302 to the exact pre-registered callback. Recommended first target: Claude.ai custom connector (highest-confidence, fully documented static-client path, works on Free). Biggest JUJU gaps: no CIMD/DCR, no RFC 9207, browser-hostile consent model, missing readOnlyHint/destructiveHint annotations, no search/fetch tools for ChatGPT deep research/company knowledge and M365 federated connectors, and strictness risks (resource param, unknown query params, PKCE-mandatory confidential clients). **Recommended first target:** Claude.ai web/desktop custom connector — highest-confidence path: official docs explicitly support a pre-registered client ('Use your own OAuth client' … 'avoids dynamic client registration entirely'), a single exact documented callback (https://claude.ai/api/mcp/auth_callback), works on every plan including Free (one custom connector), accepts 401/405 semantics matching JUJU, and needs only `juju auth add-client --redirect-uri "https://claude.ai/api/mcp/auth_callback" --public --name "Claude.ai"` followed by `juju auth pending` / `juju auth approve ` during Connect (approve within ~30 s and make /authorize return a page immediately). Perplexity (Pro/Max) is the runner-up with a fixed official callback and observed PKCE S256; ChatGPT is equally well documented but needs the per-connection callback copied from the dialog and has an unresolved Plus/Pro write-tool ambiguity. ## Matrix | Product | Can connect to JUJU | Plans | Callback URL(s) to register | Confidence | |---|---|---|---|---| | ChatGPT web (chatgpt.com) — Developer-mode custom MCP app/plugin at chatgpt.com/plugins (formerly custom connectors / Apps SDK) | ✅ yes, with caveats | Paid plans, web only (no mobile). Business/Enterprise/Edu: full read/write MCP, but an admin/owner must first enable developer mode in Admin workspace settings (Enterprise/Edu can scope via RBAC). Plus/Pro: OpenAI's own … | `https://chatgpt.com/connector/oauth/{callback_id}`
`https://chatgpt.com/connector_platform_oauth_redirect` | high | | Claude.ai web and Claude Desktop (also Cowork, mobile beta) — custom connectors (Customize/Settings → Connectors → Add custom connector) | ✅ yes, with caveats | Free, Pro, Max, Team, Enterprise. Free is limited to ONE custom connector (connectors reached Free on 2026-02-17). On Team/Enterprise only an Owner/Primary Owner can add a custom connector (Organization settings → Connec… | `https://claude.ai/api/mcp/auth_callback` | high | | Google Gemini web app (gemini.google.com) — 'Custom apps for Gemini Spark' (Settings & help → Connected Apps → Custom apps for Spark) | ✅ yes, with caveats | Only inside Gemini Spark: requires a Google AI Pro (US, English rollout 2026-07-16) or Google AI Ultra subscription, 18+, in the US, personal Google Account (not Workspace/work/school), Keep Activity ON, English only. Cu… | (none published / see caveats) | medium | | Gemini Enterprise — custom MCP server data store (Cloud editions Standard/Plus/Pay-as-you-go/Frontline; Business edition Pre-GA) | ✅ yes, with caveats | Admin-only. Cloud editions (Standard, Plus, Pay-as-you-go, Frontline): Org Policy Admin must override the managed constraint 'Disable custom MCP server connector for Gemini Enterprise' (blocked by default), admin needs r… | `https://vertexaisearch.cloud.google.com/oauth-redirect` | medium | | Mistral Le Chat web (chat.mistral.ai, renamed Mistral Vibe / Vibe Work in May 2026) — Custom MCP Connectors (chat UI, Studio console.mistral.ai, /v1/connectors API) | ✅ yes, with caveats | All plans (Free, Pro, Student, Team, Enterprise), but administrator-only: 'On Free, Pro, and Student plans, the account owner is the administrator by default'; on Team/Enterprise a workspace/org admin must add it. Studio… | `https://console.mistral.ai/build/connectors/debugger/oauth-callback` | medium | | Perplexity web app / desktop app — Custom connectors (Remote MCP); Comet browser noted | ✅ yes, with caveats | Pro, Max, Enterprise ('Pro, Max, and Enterprise subscribers can now connect Perplexity to any external tool', changelog 2026-03-13). Free cannot add custom connectors (third-party guides; official article silent on Free)… | `https://www.perplexity.ai/rest/connections/oauth_callback`
`https://enterprise.perplexity.ai/rest/connections/oauth_callback` | high | | Microsoft 365 Copilot — declarative agent with an MCP plugin (Agents Toolkit 'OAuth (with static registration)'); also agent connectors, Cowork plugins, custom federated connectors | ✅ yes, with caveats | Work/school Microsoft Entra account in an M365 tenant only. Declarative agents with custom actions work in Copilot Chat without a Microsoft 365 Copilot license (all three columns: no billing / usage-based / licensed) but… | `https://teams.microsoft.com/api/platform/v1.0/oAuthRedirect` | high | | Microsoft Copilot Studio — Tools → Add a tool → Model Context Protocol (standard harness; GitHub Copilot harness preview) | ✅ yes, with caveats | Work/school tenant. Authoring needs a Microsoft 365 Copilot add-on license, a standalone Copilot Studio subscription, or Copilot Credits / pay-as-you-go (not in GCC/GCCH); the trial can build/test but 'you can't publish … | (none published / see caveats) | medium | | Microsoft Copilot consumer (copilot.microsoft.com / Copilot app with a personal Microsoft account) and M365 Copilot Agent Builder | ❌ no | N/A — the feature does not exist. Consumer Copilot connectors are a fixed list (OneDrive, Outlook.com, Google Drive, Gmail, Google Calendar, Google Contacts) on Copilot.com and Copilot Mobile. Agent Builder (no-code, ins… | (none published / see caveats) | high | | Google AI Studio web (aistudio.google.com) and Gemini API mcp_server tool | ❌ no | N/A — no MCP-client UI exists in AI Studio web. The 'Agents in AI Studio playground' page mentions MCP servers without any UI to enter a server URL; Google staff acknowledged open feature requests (2026-08-30 / 09-01). P… | (none published / see caveats) | medium | | Grok (grok.com/connectors → New Connector → Custom) | ✅ yes, with caveats | Connectors 'available to all Grok users'; on Grok Business/Enterprise a team admin must first provision the connector. Launch date May 2026 (third-party). The separate 'Grok Bot' cloud-agent surface (beta 2026-08-11, Cur… | `https://grok.com/connectors-oauth-exchange-code/` | medium | | Cursor Cloud Agents (cursor.com/agents web) — personal/team MCP servers | ✅ yes, with caveats | 'You need to be on a paid Cursor plan'. Personal servers via the MCP dropdown in cursor.com/agents; team admins share via Dashboard → Integrations & MCP. | `https://www.cursor.com/agents/mcp/oauth/callback` | medium | | Devin (app.devin.ai) — Settings → Connections → MCP servers → Add a custom MCP | ✅ yes, with caveats | No plan tier stated on the official MCP page; requires the 'Manage MCP Servers' permission. Connection scope Organization (shared) or Personal (each member authenticates). | `https://api.devin.ai/mcp/oauth/callback` | medium | | Slack — Slackbot MCP client (developer adds the MCP server to a Slack app; members connect in Slackbot) | ✅ yes, with caveats | Slackbot MCP 'Available on all plans', but admin management of MCP server/tool access is not possible on Pro, Business+ or Enterprise Select (i.e. Enterprise+ for governance). Not end-user self-serve: a developer must ad… | `https://oauth2.slack.com/external/auth/callback` | medium | | Amazon Quick (Enterprise) — MCP connectors ('Create for your team' → Model Context Protocol) | ✅ yes, with caveats | Requires an Amazon Quick Enterprise subscription; admin-configured connector. | (none published / see caveats) | medium | | Glean — Connect remote MCP servers (admin console) | ✅ yes, with caveats | Admin-configured in the Glean admin console; plan tier not stated on the fetched page. | (none published / see caveats) | low | | Notion Custom Agents — Tools & Access → Add connection → Custom MCP server | ❌ no | Business and Enterprise plans only; workspace admin must enable/approve custom MCP servers. | (none published / see caveats) | high | | Replit Agent — Integrations → MCP Servers → Add MCP server | ❌ no | Not stated. | (none published / see caveats) | medium | | Zapier — MCP Client by Zapier (Zaps and Zapier Agents) | ❓ unknown | No stated restriction (static IPs only on Professional/Team/Enterprise). | (none published / see caveats) | low | | Make — MCP Client app (scenarios and AI Agents) | ❓ unknown | Conflicting: apps.make.com says 'available in open beta to all users'; the Make blog (2025-07-16) says 'available now on all paid plans'. | `https://www.make.com/oauth/cb/mcp` | low | | Salesforce Agentforce — Agentforce Registry (register external MCP server in Setup) | ❓ unknown | Agentforce-enabled org; admin-only; Beta status asserted by the researcher but not found on the re-fetched Salesforce pages (unverified). | (none published / see caveats) | low | | HuggingChat (hf.co/chat, huggingface/chat-ui) — user-added MCP servers | ❌ no | Free, no tier. | (none published / see caveats) | high | | Cohere North — custom MCP servers via north-mcp-python-sdk | ❌ no | Developer/admin integration; no end-user add UI documented. | (none published / see caveats) | medium | | Manus — Settings → Integrations → Custom MCP Servers | ❌ no | Not stated. | (none published / see caveats) | medium | | Codex web (chatgpt.com/codex), Kimi web (kimi.com), Qwen Chat web, Poe, You.com, DeepSeek web | ❌ no | N/A — no evidence of an end-user MCP client on the web surface. | (none published / see caveats) | medium | ## Per-product setup and caveats ### ChatGPT web (chatgpt.com) — Developer-mode custom MCP app/plugin at chatgpt.com/plugins (formerly custom connectors / Apps SDK) - **Can connect:** ✅ yes, with caveats (confidence high) - **Plans:** Paid plans, web only (no mobile). Business/Enterprise/Edu: full read/write MCP, but an admin/owner must first enable developer mode in Admin workspace settings (Enterprise/Edu can scope via RBAC). Plus/Pro: OpenAI's own pages conflict — the developer-mode guide says 'Available to Pro, Plus, Business, Enterprise, and Education accounts on the web' (full read/write), while the Help Center (≈2026-08-21) says full MCP incl. write actions is Business/Enterprise/Edu only, 'Pro users can connect MCPs with read/fetch permissions', and never mentions Plus. Free: not listed on any page. 'Team' was renamed 'Business' on 2025-08-29. - **Auth:** OAuth 2.1 authorization-code + PKCE (S256 mandatory) per the MCP authorization spec, ChatGPT acting as OAuth client. Discovery: RFC 9728 protected-resource metadata (via WWW-Authenticate on 401) then RFC 8414/OIDC. Sends `resource` on authorize and token requests, expects audience-bound tokens. Client identity precedence: (1) static/predefined credentials entered by the app creator ('For OAuth, if static credentials are provided, then they will be used'; token auth none / client_secret_post / client_secret_basic), (2) CIMD if advertised, (3) DCR if registration_endpoint exists (optional). Requests any OIDC scopes advertised in scopes_supported by default. No client-credentials/M2M, no API keys, no customer mTLS. AS metadata MUST advertise code_challenge_methods_supported ['S256'] and should publish token_endpoint_auth_methods_supported. - **Callback URL(s):** `https://chatgpt.com/connector/oauth/{callback_id}`, `https://chatgpt.com/connector_platform_oauth_redirect` Setup (owner runs these on the machine running JUJU): ```bash # Step 1 (in ChatGPT): Settings → Security and login → turn on Developer mode; go to https://chatgpt.com/plugins → plus button → name/description → Connection: public endpoint https:///mcp → Authentication: OAuth → open Advanced settings and COPY the Callback URL shown (https://chatgpt.com/connector/oauth/) before clicking Scan Tools juju auth add-client --redirect-uri "https://chatgpt.com/connector/oauth/" --name "ChatGPT" # confidential client: paste the printed client_id + client_secret into ChatGPT's OAuth Client ID / client secret fields (add --public instead for a PKCE-only client with token_endpoint_auth_method none) # Only if/when JUJU implements RFC 9207 issuer identification: juju auth add-client --redirect-uri "https://chatgpt.com/connector_platform_oauth_redirect" --name "ChatGPT (stable)" # Step 2: click Scan Tools → browser opens JUJU /authorize and waits juju auth pending juju auth approve # Step 3: wait for the tool scan, click Create → app appears under Drafts with a 'Dev' label; use via Developer mode in the + menu (or Work tab, type @ and pick the plugin); after changing tools: chatgpt.com/plugins → Refresh ``` Caveats: (1) JUJU has no RFC 9207 support, so ChatGPT uses the per-connection callback https://chatgpt.com/connector/oauth/{callback_id}; the exact value is only shown in ChatGPT (Advanced settings → Callback URL per a Salesforce guide, and on the MCP server management page) — copy it and register it in JUJU BEFORE Scan Tools, which forces the OAuth prompt at creation time. (2) AS metadata must include code_challenge_methods_supported ['S256'] ('MCP servers are unsupported' otherwise) and token_endpoint_auth_methods_supported; advertise only scopes JUJU actually issues (ChatGPT requests all advertised OIDC scopes). (3) Terminal consent: ChatGPT expects the browser authorize page to end in a redirect carrying the code; no ChatGPT-side timeout is documented — approve promptly. (4) Both /mcp and the embedded AS need a public HTTPS origin; Secure MCP Tunnel covers /mcp only ('The authorization server itself is not automatically tunneled'). (5) All 43 tools are usable in developer mode; tools without readOnlyHint:true are treated as write actions and prompt for confirmation each conversation (user-adjustable since 2026-06-12); Deep research uses read/fetch only, Agent mode ignores custom apps, company knowledge needs search/fetch tools — JUJU has none. (6) Write-tool availability on Plus/Pro is an unresolved conflict in OpenAI's docs. (7) Business workspaces cannot update a published app (recreate); Enterprise/Edu use per-action controls with new actions disabled by default. (8) Legacy /sse transport still accepted; whether ChatGPT issues GET/DELETE to /mcp and tolerates 405 is undocumented. (9) Exact current dialog field labels ('OAuth Client ID' / 'OAuth client secret') come from community/Salesforce guides, not OpenAI pages. Sources: - https://developers.openai.com/api/docs/guides/developer-mode - https://developers.openai.com/plugins/build/auth - https://developers.openai.com/plugins/deploy/connect-chatgpt - https://developers.openai.com/api/docs/guides/secure-mcp-tunnels - https://developers.openai.com/plugins/build/mcp-server - https://developers.openai.com/plugins/quickstart - https://developers.openai.com/plugins/changelog - https://developers.openai.com/api/docs/mcp - https://help.openai.com/en/articles/12584461-developer-mode-and-mcp-apps-in-chatgpt - https://help.openai.com/en/articles/11391654-chatgpt-business-release-notes - https://developer.salesforce.com/docs/platform/hosted-mcp-servers/guide/chatgpt.html - https://community.openai.com/t/unable-to-scan-tools-for-an-oauth-mcp-chatgpt-app/1374999 - https://community.openai.com/t/oauth-client-id-is-no-longer-optional/1367103 ### Claude.ai web and Claude Desktop (also Cowork, mobile beta) — custom connectors (Customize/Settings → Connectors → Add custom connector) - **Can connect:** ✅ yes, with caveats (confidence high) - **Plans:** Free, Pro, Max, Team, Enterprise. Free is limited to ONE custom connector (connectors reached Free on 2026-02-17). On Team/Enterprise only an Owner/Primary Owner can add a custom connector (Organization settings → Connectors → Add → Custom); members then click Connect. Mobile install is beta; web/Desktop are the primary path. No 'developer mode' gate. - **Auth:** OAuth 2.0/2.1 authorization-code with mandatory PKCE S256 on every request. Discovery requires a transport-level 401 with WWW-Authenticate: Bearer resource_metadata=... (a 200 wrapping an error does not trigger auth) → RFC 9728 PRM (resource must equal the URL exactly as typed; first authorization_servers entry used) → RFC 8414 or OIDC discovery. Sends RFC 8707 `resource` (canonical form) on authorize+token; scopes from 401 scope param else PRM scopes_supported plus offline_access if advertised. Client identity: DCR, CIMD (needs client_id_metadata_document_supported:true AND 'none' in token_endpoint_auth_methods_supported), or 'Use your own OAuth client' — a pre-registered client ID with optional secret ('avoids dynamic client registration entirely'); static headers (beta, limited orgs); none. No client_credentials/M2M; every connection needs user consent. Token refresh reactive on 401 + proactive ≤5 min before expiry; refresh-token rotation expected for public clients; /token must accept application/x-www-form-urlencoded and answer within 10 s (refresh 30 s). - **Callback URL(s):** `https://claude.ai/api/mcp/auth_callback` Setup (owner runs these on the machine running JUJU): ```bash juju auth add-client --redirect-uri "https://claude.ai/api/mcp/auth_callback" --public --name "Claude.ai" # public PKCE-only client recommended: Claude's token-endpoint auth method for confidential clients (basic vs post) is undocumented; drop --public only if JUJU accepts both client_secret_basic and client_secret_post # In Claude: Customize/Settings → Connectors → Add custom connector → Name + Remote MCP server URL https:///mcp → (old dialog) Advanced settings → OAuth Client ID = printed client_id, secret blank | (new two-step dialog) Authentication: Always required → OAuth client: Use your own OAuth client → client ID, secret blank → Add. Credentials are immutable after Add (remove/re-add to change). Team/Enterprise: an Owner does this under Organization settings → Connectors → Add → Custom → Web # Click Connect → popup opens JUJU /authorize; approve within ~30 s (see caveats) juju auth pending juju auth approve # Enable the connector per conversation via the + → Connectors menu; block individual tools under Customize → Connectors if needed ``` Caveats: (1) The client ID MUST be entered at Add time; if omitted Claude falls back to DCR and fails with 'Couldn't register with … sign-in service … add an OAuth Client ID' (claude-ai-mcp #402/#359). (2) Consent latency: no official timeout is documented, but open issue #899 (Aug 2026) observed Claude issuing a second GET /authorize with fresh state/PKCE ~28–47 s after the first — JUJU's /authorize must return a page immediately (never hold the HTTP response), poll until approval, then redirect with a code bound to the latest state; approve quickly. (3) Host must have a public IPv4 A record, be reachable from 160.79.104.0/21 (allowlist in WAF/CDN, lenient Origin validation), no private/CGNAT/AAAA-only, no 3xx to another host (Authorization dropped). (4) 401 + WWW-Authenticate must be on unauthenticated POST /mcp; official troubleshooting explicitly accepts 401 or 405 on a plain GET, so JUJU's 405 on GET/DELETE is fine. (5) AS metadata must advertise code_challenge_methods_supported ['S256']; PRM resource must equal the typed URL; RFC 8707 resource accepted in canonical form; discovery documents cached ~5 min. (6) Tool hygiene: names ≤64 chars; all tools should declare readOnlyHint/destructiveHint — read-only tools can run without per-call confirmation, destructive tools always prompt; otherwise every call needs approval. Max tool result ~150,000 chars, 300 s timeout. (7) Legacy HTTP+SSE still accepted but deprecated; a URL ending in /sse selects SSE. (8) Platform reliability: several 2026 claude-ai-mcp issues (#671, #506, #215, #313, #690, #702) report Claude never calling /token or not sending the bearer after a successful callback, without maintainer replies — keep the ofid_ reference ID for support. (9) MCP tunnels (private-network servers) exist only as a research preview for Enterprise by request. (10) A 'claude.com/api/mcp/auth_callback' variant appears only on a third-party page — do not rely on it. Sources: - https://claude.com/docs/connectors/building/authentication - https://claude.com/docs/connectors/custom/remote-mcp - https://claude.com/docs/connectors/building/troubleshooting - https://claude.com/docs/connectors/building/testing - https://claude.com/docs/connectors/building/index - https://claude.com/docs/connectors/building/lazy-authentication - https://claude.com/docs/connectors/building/mcp - https://claude.com/docs/connectors/building/review-criteria - https://claude.com/docs/connectors/building/directory-vs-custom - https://support.claude.com/en/articles/11175166-get-started-with-custom-connectors-using-remote-mcp - https://support.claude.com/en/articles/11176164-use-connectors-to-extend-claude-s-capabilities - https://platform.claude.com/docs/en/api/ip-addresses - https://www.anthropic.com/news/claude-sonnet-4-6 - https://github.com/anthropics/claude-ai-mcp/issues/402 - https://github.com/anthropics/claude-ai-mcp/issues/359 - https://github.com/anthropics/claude-ai-mcp/issues/899 - https://github.com/anthropics/claude-ai-mcp/issues/313 ### Google Gemini web app (gemini.google.com) — 'Custom apps for Gemini Spark' (Settings & help → Connected Apps → Custom apps for Spark) - **Can connect:** ✅ yes, with caveats (confidence medium) - **Plans:** Only inside Gemini Spark: requires a Google AI Pro (US, English rollout 2026-07-16) or Google AI Ultra subscription, 18+, in the US, personal Google Account (not Workspace/work/school), Keep Activity ON, English only. Custom apps can be added only in the web app (then usable on web + mobile Spark). Free tier: not supported. Unavailable in EEA/UK/Switzerland/Nigeria. - **Auth:** Google-hosted OAuth 2.0 browser flow. Gemini first attempts Dynamic Client Registration; if the server has none, the official help page says: next to 'Advanced features' click 'Show more', then enter your credentials (dialog: 'Automatic registration with this server failed. Please enter the OAuth client ID and client secret'); a 'Copy Redirect URL' button exposes the Google-hosted redirect URI. Community-observed (not Google-documented): Spark performs RFC 9728/8414 discovery, sends PKCE S256, presents a CIMD-style client_id on accountlinking.google.com, and uses the entered ID/secret as the real client credentials. RFC 8707 resource behaviour unknown. Blank client-secret fields do not proceed (public PKCE-only client unverified). Write actions require manual user confirmation. - **Callback URL(s):** none published Setup (owner runs these on the machine running JUJU): ```bash # In Gemini web: Settings & help → Connected Apps → Custom apps for Spark → Add a custom app → MCP server URL https:///mcp → Next → (registration fails, JUJU has no DCR) → Advanced features → Show more → click 'Copy Redirect URL' and copy the exact Google-hosted value juju auth add-client --redirect-uri "" --name "Gemini Spark" # confidential client (do NOT use --public: blank secret fields do not proceed); paste client_id + client_secret into the dialog and finish # Browser lands on JUJU /authorize juju auth pending juju auth approve # JUJU must answer with a 302 (a 303 stalled one reproduction) to the copied redirect URI ``` Caveats: (1) Redirect URI is NOT https://gemini.google.com/oauth-redirect (that was a reporter's own DCR test input, corrected by the verifier); community evidence points to oauth-redirect.googleusercontent.com / oauth-redirect-sandbox.googleusercontent.com / oauth-redirect-test.googleusercontent.com hosts (format https://oauth-redirect.googleusercontent.com/r/), exact string unverified — always copy it from the dialog. (2) Static confidential clients + PKCE S256 have been shown working end-to-end by three independent parties (2026-07-13, 08-03, 09-03), but one Aug 6 2026 report shows Spark receiving the 302 callback and never calling /token (unresolved). (3) Respond to consent with 302, not 303. (4) Do not require the RFC 8707 resource parameter (undocumented for Spark). (5) No authorize-step timeout documented; the terminal approval must finish while the user's browser waits. (6) Transport: help page only says 'must follow the standard MCP specifications' — Streamable HTTP presumed, legacy SSE unknown. (7) Heavy eligibility gating (Spark, AI Pro-US/Ultra, 18+, US, personal account, English). (8) Google AI Studio web has NO MCP-client UI (Google staff acknowledged feature requests Sep 2026); the Gemini API mcp_server tool is static-headers only and 'Gemini 3 does not support remote MCP' (2026-09-04). (9) Gemini CLI (not web) is the best-fitting Google client: oauth.clientId/clientSecret/redirectUri honoured, PKCE S256, resource param, WWW-Authenticate discovery; register http://localhost:/oauth/callback with a fixed port. Sources: - https://support.google.com/gemini/answer/17209137?hl=en&co=GENIE.Platform%3DDesktop - https://support.google.com/gemini/answer/17094507 - https://support.google.com/gemini/answer/17171264 - https://blog.google/innovation-and-ai/products/gemini-app/gemini-spark-updates-june-2026/ - https://github.com/firecrawl/firecrawl-mcp-server/issues/345 - https://github.com/homeassistant-ai/ha-mcp/issues/1787 - https://discuss.ai.google.dev/t/gemini-spark-custom-mcp-oauth-stops-after-302-callback-and-never-calls-token/177327 - https://support.poodll.com/support/solutions/articles/19000180266 - https://ai.google.dev/gemini-api/docs/aistudio-agents - https://ai.google.dev/gemini-api/docs/interactions-overview - https://geminicli.com/docs/tools/mcp-server/ - https://raw.githubusercontent.com/google-gemini/gemini-cli/main/packages/core/src/mcp/oauth-provider.ts ### Gemini Enterprise — custom MCP server data store (Cloud editions Standard/Plus/Pay-as-you-go/Frontline; Business edition Pre-GA) - **Can connect:** ✅ yes, with caveats (confidence medium) - **Plans:** Admin-only. Cloud editions (Standard, Plus, Pay-as-you-go, Frontline): Org Policy Admin must override the managed constraint 'Disable custom MCP server connector for Gemini Enterprise' (blocked by default), admin needs roles/discoveryengine.editor. Business edition (business.gemini.google, Pre-GA, page dated 2026-07-29): team administrator via Settings & help → Team → Manage team → Connected apps → Add MCP Server; connection disabled by default until enabled. - **Auth:** Admin types in OAuth 2.0 fields: Authorization URL, Token URL, Client ID, Client Secret (not marked optional), Scopes (offline_access for refresh), optional 'Enable PKCE Support' checkbox (RFC 7636), optional extra authorize params; or 'No authentication' (Preview since 2026-07-22). JUJU's RFC 8414/9728 discovery is not exercised (endpoints typed manually). Per-user authorization against JUJU's AS. Business edition auto-appends client_id, redirect_uri, scope. - **Callback URL(s):** `https://vertexaisearch.cloud.google.com/oauth-redirect` Setup (owner runs these on the machine running JUJU): ```bash juju auth add-client --redirect-uri "https://vertexaisearch.cloud.google.com/oauth-redirect" --name "Gemini Enterprise" # Cloud editions only; confidential client (Client Secret is a required field) # Console: Gemini Enterprise → Data stores → Create data store → Custom MCP Server → Server URL https:///mcp → OAuth 2.0 → Authorization URL https:///authorize, Token URL https:///token, Client ID/Secret from above, Scopes, tick Enable PKCE Support # Business edition: the redirect URI is NOT published — obtain it from the Add MCP Server form/Google support before running juju auth add-client # When a user first authorizes: juju auth pending → juju auth approve ``` Caveats: (1) StreamableHTTP only ('The old SSE transport is not supported'); TLS certificate from a publicly trusted CA (no self-signed); IdP (JUJU's AS) reachable from the public internet. (2) Business-edition redirect URI is not published anywhere fetched — unknown. (3) Limit 100 enabled actions per data store (43 is fine); Gemini Enterprise auto-calls tools/list since 2026-08-06. (4) PKCE is optional (checkbox) — if JUJU mandates PKCE for confidential clients the admin must tick it. (5) Do not require the RFC 8707 resource parameter. (6) Cloud Run-hosted servers with auth need roles/run.invoker for the Discovery Engine service agent. (7) Consent: terminal approval must complete while the user's browser waits; no timeout documented. Sources: - https://docs.cloud.google.com/gemini/enterprise/docs/connectors/custom-mcp-server/set-up-custom-mcp-server - https://docs.cloud.google.com/gemini/enterprise/docs/connectors/custom-mcp-server/overview - https://docs.cloud.google.com/gemini/enterprise/docs/connectors/custom-mcp-server/override-constraint-for-custom-mcp-data-stores - https://docs.cloud.google.com/gemini/enterprise/docs/release-notes - https://support.google.com/g/answer/17106276?hl=en ### Mistral Le Chat web (chat.mistral.ai, renamed Mistral Vibe / Vibe Work in May 2026) — Custom MCP Connectors (chat UI, Studio console.mistral.ai, /v1/connectors API) - **Can connect:** ✅ yes, with caveats (confidence medium) - **Plans:** All plans (Free, Pro, Student, Team, Enterprise), but administrator-only: 'On Free, Pro, and Student plans, the account owner is the administrator by default'; on Team/Enterprise a workspace/org admin must add it. Studio/API route (Public Preview) needs a Mistral Studio account. - **Auth:** Auto-detected: None; HTTP Bearer/Basic (org-level headers); or 'OAuth 2.1 (with dynamic client registration)'. Discovery via .well-known (RFC 9728/8414; expects 401 + WWW-Authenticate), with optional RFC 8414 override (oauth2_server_metadata / oauth2_server_metadata_url in the API). Static client path: chat UI 'OAuth2 Advanced Settings' (Client ID/Secret), Studio 'OAuth 2.1 Advanced settings' (Redirect URI, Client ID, Client Secret), Debugger ('For OAuth, enter Client ID and Client Secret'), API auth_data{client_id, client_secret}. Third-party capture (2026-03-03) shows Mistral's own DCR requesting token_endpoint_auth_method client_secret_basic, scope offline_access, grant_types authorization_code+refresh_token, PKCE in use, and NO resource/audience parameter sent. Passing OAuth tokens programmatically is not supported. - **Callback URL(s):** `https://console.mistral.ai/build/connectors/debugger/oauth-callback` Setup (owner runs these on the machine running JUJU): ```bash # Optional pre-check with the official Studio Connectors Debugger (uses its own callback): juju auth add-client --redirect-uri "https://console.mistral.ai/build/connectors/debugger/oauth-callback" --name "Mistral Debugger" # Production: in chat.mistral.ai → Context → Connectors → + Add Connector → Custom MCP Connector tab → name + Server URL https:///mcp → Authentication OAuth2.1 → open OAuth2 Advanced Settings and COPY the Redirect URI shown there (unofficially observed as https://callback.mistral.ai/v1/integrations_auth/oauth2_callback — verify in the UI) juju auth add-client --redirect-uri "" --name "Mistral Vibe" # confidential client (Mistral's flow uses client_secret_basic; secret-less clients unproven) — paste client_id + client_secret into the Advanced fields, click Connect juju auth pending juju auth approve # within ~10 minutes (Studio/Workflows auth-URL TTL; chat-UI timeout undocumented) # Then in a chat enable the connector via Tools/+ and set per-function 'Always allow' under My Connectors ``` Caveats: (1) Official docs frame OAuth as 'with dynamic client registration'; the static-credential path in the chat UI is evidenced only by third-party guides (Tredict — a no-DCR, RFC 9728 + PKCE S256 server exactly like JUJU — and Qlik), plus official hooks in the Debugger and the API's auth_data. (2) Production redirect URI https://callback.mistral.ai/v1/integrations_auth/oauth2_callback is from a single third-party capture — unofficial; copy the value shown in the connector form's Advanced section. (3) Register a confidential client; accept both client_secret_basic and client_secret_post to be safe. (4) JUJU must accept authorize/token requests WITHOUT the RFC 8707 resource parameter and must not reject scope offline_access / grant_type refresh_token. (5) Sidebar label is now 'Context → Connectors' (older guides say 'Intelligence'). (6) Limitations: no dynamic tool discovery (tools/list_changed ignored), no resources, no automatic prompt templates; connector name ≤64 chars alnum/_/-; per-function Read/Write toggles; admins can disable individual tools org-wide. (7) Streamable HTTP is the standard; SSE is also demonstrably accepted; 405 on GET/DELETE not treated as a failure in docs. (8) Public HTTPS with valid TLS certificate required. (9) The sweep verifier's statement that Le Chat is 'DCR only' conflicts with the dedicated Mistral verification above; treat the static path as probable-but-third-party. Sources: - https://docs.mistral.ai/vibe/work/connectors/mcp-connectors - https://docs.mistral.ai/le-chat/knowledge-integrations/connectors/mcp-connectors - https://docs.mistral.ai/studio-api/connectors/debugger - https://docs.mistral.ai/studio-api/connectors/management - https://docs.mistral.ai/api/endpoint/beta/connectors - https://docs.mistral.ai/studio-api/workflows/building-workflows/connectors - https://mistral.ai/news/le-chat-mcp-connectors-memories/ - https://mistral.ai/news/connectors/ - https://mistral.ai/news/more-control-over-connectors/ - https://www.tredict.com/faq/connect-mistral-vibe-with-tredict/ - https://community.qlik.com/t5/Official-Support-Articles/Setting-up-the-Qlik-MCP-server-for-Mistral-Vibe/ta-p/2553555 - https://adriensieg.substack.com/p/how-can-you-securely-protect-your ### Perplexity web app / desktop app — Custom connectors (Remote MCP); Comet browser noted - **Can connect:** ✅ yes, with caveats (confidence high) - **Plans:** Pro, Max, Enterprise ('Pro, Max, and Enterprise subscribers can now connect Perplexity to any external tool', changelog 2026-03-13). Free cannot add custom connectors (third-party guides; official article silent on Free). Enterprise members need the admin toggle 'Allow members to add custom connectors' (disabled by default); only admins share org-wide. No developer-mode gate. - **Auth:** Authentication = OAuth 2.0 / API Key / None. OAuth: discovery via /.well-known/oauth-authorization-server (RFC 8414); DCR used when the server offers it, otherwise 'You may need to supply a Client ID and Client Secret if the MCP server does not support dynamic client registration' (native/public clients leave the secret blank; web/confidential clients enter it). PKCE S256 observed in Perplexity's authorize request (code_challenge_method=S256); Perplexity's DCR registers as a public client (token_endpoint_auth_method none). Appends a non-standard actor=user query parameter to the authorize URL. RFC 9728 PRM / WWW-Authenticate-driven discovery and RFC 8707 resource indicators are unverified. Optional network layer: Cloudflare Access service-token headers; AWS PrivateLink (Enterprise). - **Callback URL(s):** `https://www.perplexity.ai/rest/connections/oauth_callback`, `https://enterprise.perplexity.ai/rest/connections/oauth_callback` Setup (owner runs these on the machine running JUJU): ```bash juju auth add-client --redirect-uri "https://www.perplexity.ai/rest/connections/oauth_callback" --public --name "Perplexity" # public PKCE client (secret blank) — or omit --public for a confidential client and enter the secret # Enterprise subdomain tenants instead: juju auth add-client --redirect-uri "https://enterprise.perplexity.ai/rest/connections/oauth_callback" --public --name "Perplexity Enterprise" # In Perplexity: Account settings → Connectors → + Custom connector → Remote → Name, MCP Server URL https:///mcp → Authentication: OAuth → Advanced: Client ID = printed client_id (secret blank for public) → Transport: Streamable HTTP → tick the risk acknowledgement → Add (create-time probe runs) → click the connector card to start OAuth juju auth pending juju auth approve # Enable the connector per thread under Sources/Connectors; optionally set tools to 'Always ask' ``` Caveats: (1) JUJU's /authorize must ignore the unknown actor=user query parameter (Supabase had to patch for it). (2) The create-time verification probe is reportedly an unauthenticated POST initialize (third-party README), so JUJU's 401 + WWW-Authenticate must trigger discovery; Qlik/Conductor (OAuth, no DCR) working suggests this is fine but it is not officially documented; 405 on GET undocumented. (3) Host must be public HTTPS reachable from Perplexity datacenter IPs; a CDN Managed Challenge makes the probe fail with 403. (4) Perplexity's OAuth client was unstable in 2026 (May–June DCR public-client bug, 'Unable to start connection' toasts); none affects a no-DCR server directly but expect UI flakiness. (5) No data on how a 43-tool server is handled; no tool-name rules. (6) Comet browser: no documented custom-connector path for the Comet Assistant/sidebar (third-party, June 2026: catalog connectors only); the perplexity.ai web app can be used inside Comet. (7) Official pages are Cloudflare-blocked to fetchers; content verified from Wayback captures (help article 'Last updated on August 14, 2026'). Sources: - https://www.perplexity.ai/help-center/en/articles/13915507-adding-custom-remote-connectors - https://www.perplexity.ai/changelog/what-we-shipped---march-13-2026 - https://community.qlik.com/t5/Official-Support-Articles/Connect-Perplexity-ai-to-Qlik-MCP-server/ta-p/2552671 - https://www.conductor.com/docs/mcp/perplexity/ - https://github.com/supabase/mcp/issues/231 - https://community.perplexity.ai/t/custom-mcp-connector-fails-with-did-not-return-a-client-secret-for-rfc-7591-compliant-public-client-registrations/5172 - https://github.com/homeassistant-ai/ha-mcp/discussions/779 - https://releasebot.io/updates/perplexity-ai - https://www.perplexity.ai/help-center/en/articles/11172798-getting-started-with-comet - https://segmentstream.com/blog/articles/best-mcp-servers-for-perplexity ### Microsoft 365 Copilot — declarative agent with an MCP plugin (Agents Toolkit 'OAuth (with static registration)'); also agent connectors, Cowork plugins, custom federated connectors - **Can connect:** ✅ yes, with caveats (confidence high) - **Plans:** Work/school Microsoft Entra account in an M365 tenant only. Declarative agents with custom actions work in Copilot Chat without a Microsoft 365 Copilot license (all three columns: no billing / usage-based / licensed) but need admin-enabled 'Upload custom apps' and 'Copilot Access Enabled'; developer mode (-developer on) is licensed-only. Cowork plugins need Copilot Cowork (not on mobile). Custom federated connectors: Global Administrator or AI Administrator. Agent 365 BYO MCP: AI admin/Global admin approval, preview. - **Auth:** OAuth 2.0 authorization-code with Microsoft-hosted redirect and Microsoft-held tokens (Microsoft Enterprise token store). Schemes for MCP plugins: Entra SSO, DCR (server must issue a client secret; Teams Dev Portal lacks DCR), OAuth 2.0 auth code with static registration, None (API key not supported for MCP plugins). Static OAuth: 'PKCE is enabled by default' and public clients without a secret are explicitly allowed; Agents Toolkit reads JUJU's well-known metadata (RFC 9728 → 8414) at design time to fill authorize/token/refresh endpoints. RFC 8707 resource, runtime WWW-Authenticate/RFC 9728 handling: not documented (unknown). - **Callback URL(s):** `https://teams.microsoft.com/api/platform/v1.0/oAuthRedirect` Setup (owner runs these on the machine running JUJU): ```bash juju auth add-client --redirect-uri "https://teams.microsoft.com/api/platform/v1.0/oAuthRedirect" --public --name "Microsoft 365 Copilot" # public PKCE client allowed; omit --public if you want a confidential client (the declarative-agent-developer skill path requires a secret) # VS Code + Microsoft 365 Agents Toolkit ≥ 6.12.0: Create a New Agent/App → Declarative Agent → Add an Action → Start with an MCP Server → URL https:///mcp → Authentication: OAuth (with static registration) → Client ID (+ secret if confidential), scopes → Toolkit fetches endpoints from JUJU's well-known metadata and creates the auth config (or create it in Teams Developer Portal → Tools → OAuth client registration with Restrict usage = 'Any Teams app', Base URL = MCP server URL, PKCE on) # Lifecycle → Provision → open https://m365.cloud.microsoft/chat → Agents → dev → prompt → 'Sign in to {agent}' juju auth pending juju auth approve ``` Caveats: (1) Not available on consumer copilot.microsoft.com or personal accounts. (2) Teams Dev Portal OAuth registration must be restricted to 'Any Teams app' or every tool call returns 404; Base URL must equal the MCP server URL. (3) Terminal consent: Microsoft opens a sign-in pop-up/consent card and expects the IdP to redirect to its callback; no timeout documented. (4) Do not hard-require the resource parameter or expect runtime reaction to 401 challenges (undocumented). (5) Org-wide publishing needs admin approval; custom federated connectors are admin-only and expect read-only tools (examples search/fetch/query) — poor fit for JUJU's edit/run/git tools; Cowork plugins require safety annotations on all tools (unannotated = destructive, needs confirmation), ≤10 connectors/package, <30 s per call. (6) Transport: Streamable HTTP over HTTPS, TLS 1.2+, publicly accessible, must answer tools/list. (7) Agent 365 BYO MCP is preview: tools snapshot at registration, no republish/delete, Copilot Studio/VS Code/Claude Code/GH Copilot CLI only. Sources: - https://learn.microsoft.com/en-us/microsoft-365/copilot/extensibility/plugin-authentication-oauth - https://learn.microsoft.com/en-us/microsoft-365/copilot/extensibility/build-mcp-plugins - https://learn.microsoft.com/en-us/microsoft-365/copilot/extensibility/plugin-authentication - https://learn.microsoft.com/en-us/microsoft-365/copilot/extensibility/plugin-authentication-dynamic-client-registration - https://learn.microsoft.com/en-us/microsoft-365/copilot/extensibility/prerequisites - https://learn.microsoft.com/en-us/microsoftteams/platform/m365-apps/agent-connectors - https://learn.microsoft.com/en-us/microsoft-365/copilot/cowork/cowork-plugin-development - https://learn.microsoft.com/en-us/microsoft-365/copilot/connectors/set-up-custom-federated-connectors - https://learn.microsoft.com/en-us/microsoft-365/admin/manage/manage-tools-for-agent - https://devblogs.microsoft.com/microsoft365dev/build-declarative-agents-for-microsoft-365-copilot-with-mcp/ ### Microsoft Copilot Studio — Tools → Add a tool → Model Context Protocol (standard harness; GitHub Copilot harness preview) - **Can connect:** ✅ yes, with caveats (confidence medium) - **Plans:** Work/school tenant. Authoring needs a Microsoft 365 Copilot add-on license, a standalone Copilot Studio subscription, or Copilot Credits / pay-as-you-go (not in GCC/GCCH); the trial can build/test but 'you can't publish the agent'; the Copilot Studio for Teams plan lacks generative orchestration and premium connectors so cannot use MCP. Power Platform admin must enable Generative AI features; M365 admin must deploy the Copilot Studio app; DLP policies may block. GitHub Copilot harness MCP tools (preview, Jul 2026) consume Copilot Credits. - **Auth:** Wizard OAuth 2.0 types: Dynamic discovery (DCR + discovery), Dynamic (DCR + manual endpoints), Manual (Client ID, Client secret [required], Authorization URL, Token URL template, Refresh URL, Scopes); also API key and None. Client-credentials grant unsupported. PKCE S256 for the Manual/generic OAuth 2 connector is NOT documented on any Microsoft page; a Power Platform forum thread reports it omits code_challenge (unanswered); 2026 third-party blogs conflict. A Microsoft Q&A (Jun 2026, unresolved) reports Manual OAuth never calling the refresh endpoint on token expiry. Creates a Power Platform custom connector + connection behind the scenes. - **Callback URL(s):** none published Setup (owner runs these on the machine running JUJU): ```bash # In Copilot Studio: agent (generative orchestration ON) → Tools → Add a tool → New tool → Model Context Protocol → Server name/description, Server URL https:///mcp → Authentication: OAuth 2.0 → Type: Manual → Client ID/secret (placeholders for now), Authorization URL https:///authorize, Token URL https:///token, Refresh URL https:///token, Scopes → Create → COPY the per-connector callback URL shown (pattern https://global.consent.azure-apim.net/redirect/; paste verbatim, do not decode the -2d/-5f segments) juju auth add-client --redirect-uri "" --name "Copilot Studio" # confidential client — Client secret is a required field; then update the connector's Client ID/secret with the printed values # Next → Create a new connection → sign in (consent card) → browser hits JUJU /authorize juju auth pending juju auth approve # Add to agent; enable individual tools per agent ``` Caveats: (1) Callback URL is unique per connector and only revealed after Create (Power Platform per-connector redirect URIs enforced since Feb 2024); the bare https://global.consent.azure-apim.net/redirect is the legacy global URI and is not what a new connector sends — no fixed exact string can be pre-registered. (2) PKCE risk: if JUJU enforces PKCE for confidential clients this path may fail because the generic OAuth 2 connector may not send code_challenge (undocumented; prefer the M365 declarative-agent path where PKCE is on by default). (3) Refresh: reported never to call /token on expiry → issue long-lived access tokens for this client or expect users to reconnect. (4) Streamable HTTP only ('no longer supports SSE for MCP after August 2025'); POST /mcp mapped via x-ms-agentic-protocol: mcp-streamable-1.0, so 405 on GET/DELETE is consistent. (5) Supports MCP tools and resources, not prompts; tools with reference-type inputs are filtered, enums become strings, array-of-types truncates schemas, integer exclusiveMinimum throws; clear server description needed for orchestration. (6) GitHub Copilot harness caps concurrent MCP server instances per conversation and counts each server against the agent's tool total (no number published). (7) Every new agent gets a mandatory Entra Agent ID since Jul 2026. (8) Do not hard-require the resource parameter (undocumented). (9) Terminal consent must finish within an undocumented timeout. Sources: - https://learn.microsoft.com/en-us/microsoft-copilot-studio/mcp-add-existing-server-to-agent - https://learn.microsoft.com/en-us/microsoft-copilot-studio/agent-extend-action-mcp - https://learn.microsoft.com/en-us/microsoft-copilot-studio/mcp-troubleshooting - https://learn.microsoft.com/en-us/microsoft-copilot-studio/agents-experience/tools-add-mcp-server - https://learn.microsoft.com/en-us/microsoft-copilot-studio/requirements-licensing-subscriptions - https://learn.microsoft.com/en-us/connectors/custom-connectors/ - https://learn.microsoft.com/en-us/connectors/custom-connectors/connection-parameters - https://microsoft.github.io/mcscatblog/posts/snowflake-mcp-copilot-studio/ - https://github.com/amgdy/azure-devops-mcp-for-copilot-studio/ - https://communitypowerplatformprod.powerappsportals.com/forums/thread/details/?threadid=2d91bf5e-a28a-f111-ab10-7c1e52fed964 - https://learn.microsoft.com/en-us/answers/questions/5922525/copilot-studio-mcp-server-with-manual-oauth-2-0-pr - https://www.microsoft.com/en-us/microsoft-copilot/blog/copilot-studio/model-context-protocol-mcp-is-now-generally-available-in-microsoft-copilot-studio/ ### Microsoft Copilot consumer (copilot.microsoft.com / Copilot app with a personal Microsoft account) and M365 Copilot Agent Builder - **Can connect:** ❌ no (confidence high) - **Plans:** N/A — the feature does not exist. Consumer Copilot connectors are a fixed list (OneDrive, Outlook.com, Google Drive, Gmail, Google Calendar, Google Contacts) on Copilot.com and Copilot Mobile. Agent Builder (no-code, inside M365 Copilot) is limited to knowledge sources: 'If you need more advanced capabilities like Actions to integrate external services, use Microsoft Copilot Studio'. - **Auth:** None available for custom MCP servers. - **Callback URL(s):** none published Setup (owner runs these on the machine running JUJU): ```bash ``` Caveats: The consumer/work Copilot 'super app' merger began 2026-08-18 (press), but the official consumer support page still lists only six fixed connectors and no custom/MCP option. Use Copilot Studio or a declarative agent in a work/school tenant instead. Sources: - https://support.microsoft.com/en-us/microsoft-copilot/connecting-microsoft-copilot-to-other-services - https://learn.microsoft.com/en-us/microsoft-365/copilot/extensibility/agent-builder - https://www.bighatgroup.com/blog/copilot-weekly-2026-08-18/ ### Google AI Studio web (aistudio.google.com) and Gemini API mcp_server tool - **Can connect:** ❌ no (confidence medium) - **Plans:** N/A — no MCP-client UI exists in AI Studio web. The 'Agents in AI Studio playground' page mentions MCP servers without any UI to enter a server URL; Google staff acknowledged open feature requests (2026-08-30 / 09-01). Programmatically, the Interactions/Antigravity mcp_server tool takes url + static headers only (Streamable HTTP), no OAuth flow, and 'Gemini 3 does not support remote MCP, this is coming soon' (2026-09-04). - **Auth:** No OAuth authorization-code flow; static headers only in the API tool. - **Callback URL(s):** none published Setup (owner runs these on the machine running JUJU): ```bash ``` Caveats: If JUJU ever exposes a bearer/API-key header path, the Gemini API mcp_server tool could use it (server names must be lowercase alphanumeric, no '-'). Sources: - https://ai.google.dev/gemini-api/docs/aistudio-agents - https://ai.google.dev/gemini-api/docs/interactions-overview - https://ai.google.dev/gemini-api/docs/function-calling - https://discuss.ai.google.dev/t/google-ai-studio-mcp-abilites/180142 - https://discuss.ai.google.dev/t/feature-request-native-mcp-client-support-via-sse-http-tunnels-in-google-ai-studio/180380 ### Grok (grok.com/connectors → New Connector → Custom) - **Can connect:** ✅ yes, with caveats (confidence medium) - **Plans:** Connectors 'available to all Grok users'; on Grok Business/Enterprise a team admin must first provision the connector. Launch date May 2026 (third-party). The separate 'Grok Bot' cloud-agent surface (beta 2026-08-11, Cursor Ultra/SuperGrok Heavy) is a different UI. - **Auth:** Official docs: 'Enter the MCP server URL and complete any required authentication'; the OAuth credential screen is documented only by third-party vendor guides (pearmcp.com, flashalpha.com): Client ID, Client Secret (blank for public client), Authorization/Token endpoints (auto-discovered per pearmcp along with mcp: scopes), Scopes, Token Auth Method 'none (PKCE only)', PKCE S256, then Save & Connect. RFC 8707 support unknown. - **Callback URL(s):** `https://grok.com/connectors-oauth-exchange-code/` Setup (owner runs these on the machine running JUJU): ```bash juju auth add-client --redirect-uri "https://grok.com/connectors-oauth-exchange-code/" --public --name "Grok" # callback string is third-party-sourced (two independent guides), not on docs.x.ai — confirm in Grok's dialog before relying on it # grok.com/connectors → New Connector → Custom → URL https:///mcp → OAuth screen: Client ID = printed client_id, secret blank, Token Auth 'none (PKCE only)' → Save & Connect juju auth pending juju auth approve ``` Caveats: Grok rejects localhost/private-network URLs (public HTTPS required; Cloudflare quick tunnels do not support SSE, so Streamable HTTP is the safe transport). The OAuth screen and callback are not on any official xAI page. No timeout for the terminal consent documented. Sources: - https://docs.x.ai/grok/connectors - https://docs.x.ai/grok/connectors/custom-mcp-tunneling - https://pearmcp.com/guides/grok - https://flashalpha.com/docs/mcp - https://forum.cursor.com/t/grok-bot-custom-mcp-needs-static-oauth-client-id-blocks-oracle-netsuite/168121 ### Cursor Cloud Agents (cursor.com/agents web) — personal/team MCP servers - **Can connect:** ✅ yes, with caveats (confidence medium) - **Plans:** 'You need to be on a paid Cursor plan'. Personal servers via the MCP dropdown in cursor.com/agents; team admins share via Dashboard → Integrations & MCP. - **Auth:** Per-user OAuth; static OAuth client credentials (CLIENT_ID required, CLIENT_SECRET optional) supported 'instead of dynamic client registration' when the provider lacks DCR; headers also supported. Cloud UI stores client secrets as redacted sensitive fields; tool calls proxied through Cursor's backend (VM never sees tokens). Static CLIENT_ID confirmed working end-to-end on cloud agents (forum, 2026-08-21). - **Callback URL(s):** `https://www.cursor.com/agents/mcp/oauth/callback` Setup (owner runs these on the machine running JUJU): ```bash juju auth add-client --redirect-uri "https://www.cursor.com/agents/mcp/oauth/callback" --public --name "Cursor Cloud Agents" # desktop Cursor uses http://localhost:8787/callback instead # cursor.com/agents → MCP dropdown → add HTTP server https:///mcp with CLIENT_ID (and CLIENT_SECRET if confidential) → Connect juju auth pending juju auth approve ``` Caveats: HTTP (Streamable) or stdio only for cloud agents — 'SSE and mcp-remote are not supported'. Paid plan required. Terminal consent timeout undocumented. Sources: - https://cursor.com/docs/mcp - https://cursor.com/docs/cloud-agent/capabilities - https://cursor.com/docs/cloud-agent ### Devin (app.devin.ai) — Settings → Connections → MCP servers → Add a custom MCP - **Can connect:** ✅ yes, with caveats (confidence medium) - **Plans:** No plan tier stated on the official MCP page; requires the 'Manage MCP Servers' permission. Connection scope Organization (shared) or Personal (each member authenticates). - **Auth:** None / Auth Header / OAuth. 'If your provider requires pre-registered OAuth applications (no dynamic client registration), supply your own client ID and secret' under OAuth credentials; Devin prompts to complete OAuth in the first session. Transport STDIO / SSE (legacy) / HTTP (Streamable, recommended). - **Callback URL(s):** `https://api.devin.ai/mcp/oauth/callback` Setup (owner runs these on the machine running JUJU): ```bash juju auth add-client --redirect-uri "https://api.devin.ai/mcp/oauth/callback" --name "Devin" # confidential (client ID + secret expected) # Devin: Settings → Connections → MCP servers → Add a custom MCP → transport HTTP → URL https:///mcp → auth OAuth → enter client ID/secret → start a session and complete the OAuth prompt juju auth pending juju auth approve ``` Caveats: Whether Devin accepts a public (secret-less) client is not stated; relies on discovery from 401/.well-known (not detailed); RFC 8707 unknown; consent timeout undocumented. Sources: - https://docs.devin.ai/work-with-devin/mcp ### Slack — Slackbot MCP client (developer adds the MCP server to a Slack app; members connect in Slackbot) - **Can connect:** ✅ yes, with caveats (confidence medium) - **Plans:** Slackbot MCP 'Available on all plans', but admin management of MCP server/tool access is not possible on Pro, Business+ or Enterprise Select (i.e. Enterprise+ for governance). Not end-user self-serve: a developer must add the server to a Slack app (App Settings or manifest) and install it. - **Auth:** Auth types: No auth / Slack identity / Dynamic Client Registration / Manual OAuth. Manual OAuth ('Use when your MCP server doesn't support DCR'): authorization URL, token URL, scopes, identity endpoint, client_id + client_secret required, PKCE optional toggle. Streamable HTTP only ('deprecated standalone HTTP+SSE transport and stdio are not supported'). - **Callback URL(s):** `https://oauth2.slack.com/external/auth/callback` Setup (owner runs these on the machine running JUJU): ```bash juju auth add-client --redirect-uri "https://oauth2.slack.com/external/auth/callback" --name "Slackbot" # confidential client (client_secret required by Manual OAuth) # Slack app settings/manifest: add MCP server → Name, HTTPS URL https:///mcp, Auth Type = Manual OAuth → authorization URL https:///authorize, token URL https:///token, scopes, client_id/secret, enable PKCE → install app → members connect the server in Slackbot juju auth pending juju auth approve # once per member who connects ``` Caveats: Every write/delete tool call needs explicit per-action user confirmation; GA release activates read-only tools by default. An 'identity endpoint' field exists — JUJU may need a userinfo-style endpoint (unverified). Governance controls only on Enterprise+. Sources: - https://docs.slack.dev/ai/slackbot-mcp-client/ - https://slack.com/help/articles/52414744085139-Connect-Slackbot-to-other-apps-with-MCP - https://www.salesforce.com/blog/connect-agentforce-external-mcp-servers/ ### Amazon Quick (Enterprise) — MCP connectors ('Create for your team' → Model Context Protocol) - **Can connect:** ✅ yes, with caveats (confidence medium) - **Plans:** Requires an Amazon Quick Enterprise subscription; admin-configured connector. - **Auth:** RFC 9728 discovery from the 401 WWW-Authenticate resource_metadata (fallback to root .well-known; path-insertion discovery NOT supported), DCR if registration_endpoint exists, else manual Client ID / 'Public OAuth client' checkbox / Client Secret / Token URL / Authorization URL / Redirect URL. PKCE S256 and Resource Indicators (RFC 8707) used; CIMD not supported. Streamable HTTP preferred over SSE; stdio not supported. - **Callback URL(s):** none published Setup (owner runs these on the machine running JUJU): ```bash # Obtain the Amazon Quick callback URI from the connector creation form (not printed on the doc page: 'Connector creation might fail if the Amazon Quick callback URI is not allow-listed') juju auth add-client --redirect-uri "" --public --name "Amazon Quick" # tick 'Public OAuth client' in Quick; or omit --public and enter the secret # Quick: Connectors → Create for your team → Model Context Protocol → endpoint https:///mcp → user OAuth → manual credentials juju auth pending juju auth approve ``` Caveats: Serve /.well-known/oauth-protected-resource at the origin root and advertise scopes_supported (otherwise default scopes are applied). Max 100 tools per server (43 OK); custom HTTP headers not supported; tool changes need a manual Sync. Exact callback URI unverified. Sources: - https://docs.aws.amazon.com/quick/latest/userguide/mcp-integration.html ### Glean — Connect remote MCP servers (admin console) - **Can connect:** ✅ yes, with caveats (confidence low) - **Plans:** Admin-configured in the Glean admin console; plan tier not stated on the fetched page. - **Auth:** 'Dynamic Client Registration' option or manual Authorization URL / Token URL / Client ID / optional Client secret ('Client secret isn't required for public authorization clients') / Scopes. Transport SSE or Streaming HTTP. Admin connects first to retrieve the tool list. - **Callback URL(s):** none published Setup (owner runs these on the machine running JUJU): ```bash # Obtain Glean's redirect URI from the admin console form (not published on the fetched page) juju auth add-client --redirect-uri "" --public --name "Glean" # Glean admin console: connect remote MCP server → https:///mcp → manual OAuth fields → connect to fetch tools juju auth pending juju auth approve ``` Caveats: Callback URI, PKCE behaviour and resource-indicator support not on the fetched page (unknown). Only surfaced by the sweep verifier, single official source. Sources: - https://docs.glean.com/administration/tools/connect-remote-mcp-servers-to-glean ### Notion Custom Agents — Tools & Access → Add connection → Custom MCP server - **Can connect:** ❌ no (confidence high) - **Plans:** Business and Enterprise plans only; workspace admin must enable/approve custom MCP servers. - **Auth:** OAuth requires Dynamic Client Registration: 'Some OAuth servers don't support dynamic client registration (DCR). This means Notion must pre-register a client application... If the server you want to use doesn't support DCR, check its documentation to see if you can use an API key or bearer token instead'; 'If neither option is available, the MCP server can't be used with Custom Agents'. - **Callback URL(s):** none published Setup (owner runs these on the machine running JUJU): ```bash ``` Caveats: Blocked by JUJU's missing RFC 7591 endpoint unless JUJU adds DCR or a bearer/API-key header path. No callback URL published. Sources: - https://www.notion.com/help/mcp-connections-for-custom-agents ### Replit Agent — Integrations → MCP Servers → Add MCP server - **Can connect:** ❌ no (confidence medium) - **Plans:** Not stated. - **Auth:** 'if the server supports OAuth DCR, Replit automatically detects and registers the client for you'; otherwise custom headers (e.g. X-API-Key) via Advanced settings. No field for a pre-registered client_id and no published callback URL found. - **Callback URL(s):** none published Setup (owner runs these on the machine running JUJU): ```bash ``` Caveats: Only DCR auto-registration is documented, so JUJU's static-client OAuth is unlikely to complete; would work if JUJU added DCR or a header/API-key auth path. All MCP traffic passes Replit's security scanner. Sources: - https://docs.replit.com/build/connect-via-mcp - https://docs.replit.com/replitai/mcp/overview ### Zapier — MCP Client by Zapier (Zaps and Zapier Agents) - **Can connect:** ❓ unknown (confidence low) - **Plans:** No stated restriction (static IPs only on Professional/Team/Enterprise). - **Auth:** Server URL + transport 'Streamable HTTP' or 'SSE' + a yes/no 'requires OAuth connection' toggle (if Yes, the Bearer Token field is ignored) or a bearer token. No statement about DCR vs static client credentials and no callback URL on the page (updated 2026-08-21). - **Callback URL(s):** none published Setup (owner runs these on the machine running JUJU): ```bash # Cannot be pre-registered: Zapier publishes no redirect URI and no client-credential fields — test with OAuth = Yes and capture the redirect_uri JUJU receives (JUJU will reject it until registered), then: juju auth add-client --redirect-uri "" --name "Zapier" (only works if Zapier can present a static client_id — unknown) ``` Caveats: Whether Zapier's OAuth path is DCR-only or accepts a pre-registered client is undocumented; treat as unknown. Sources: - https://help.zapier.com/hc/en-us/articles/38777069364109-Connect-remote-MCP-servers-to-Zapier-using-MCP-Client ### Make — MCP Client app (scenarios and AI Agents) - **Can connect:** ❓ unknown (confidence low) - **Plans:** Conflicting: apps.make.com says 'available in open beta to all users'; the Make blog (2025-07-16) says 'available now on all paid plans'. - **Auth:** API key/token if required; for OAuth servers 'some mcp servers may require you to set up a redirect uri for oauth connections' with redirect URI https://www.make.com/oauth/cb/mcp. No client ID/secret fields and no DCR statement found on the page. - **Callback URL(s):** `https://www.make.com/oauth/cb/mcp` Setup (owner runs these on the machine running JUJU): ```bash juju auth add-client --redirect-uri "https://www.make.com/oauth/cb/mcp" --name "Make" # only useful if Make can present a static client_id — undocumented (unknown) # Make: add MCP Client module → create connection → manual URL https:///mcp ``` Caveats: Redirect URI is official, but whether a pre-registered client_id can be entered (or Make requires DCR) is unknown; Make's verified server list is SSE-suffixed, so Streamable HTTP acceptance for manual URLs is not confirmed either. Sources: - https://apps.make.com/mcp-client - https://www.make.com/en/blog/mcp-client ### Salesforce Agentforce — Agentforce Registry (register external MCP server in Setup) - **Can connect:** ❓ unknown (confidence low) - **Plans:** Agentforce-enabled org; admin-only; Beta status asserted by the researcher but not found on the re-fetched Salesforce pages (unverified). - **Auth:** 'If the server requires authentication, it has to support OAuth 2.0' — authorization_code per-user via auto-generated External/Named Credential + Permission Set, or client_credentials for a service account. Credential fields and callback URL unknown (help article body renders only its TOC). - **Callback URL(s):** none published Setup (owner runs these on the machine running JUJU): ```bash # Salesforce Setup → Agentforce Registry → New → wizard (endpoint https:///mcp, OAuth 2.0 authorization_code) → read the External Credential's callback URL from the generated Named/External Credential, then: juju auth add-client --redirect-uri "" --name "Agentforce" # confidential; exact URL unverified (Salesforce Named Credentials normally use https://.my.salesforce.com/services/authcallback/, not confirmed here) juju auth pending juju auth approve ``` Caveats: Help-article body unretrievable; callback URL, PKCE, DCR-vs-static and Beta status all unverified. Tool selection is per-agent in Agent Builder (not 'allowlisted at registration'). Sources: - https://www.salesforce.com/blog/connect-agentforce-external-mcp-servers/ - https://help.salesforce.com/s/articleView?id=ai.agent_mcp_connect_register.htm&language=en_US&type=5 - https://www.infallibletechie.com/2026/03/connect-an-mcp-server-to-a-salesforce-agentforce-agent.html ### HuggingChat (hf.co/chat, huggingface/chat-ui) — user-added MCP servers - **Can connect:** ❌ no (confidence high) - **Plans:** Free, no tier. - **Auth:** None for user-added servers (name + URL + Health Check, stored in the browser); only admin-configured base servers accept headers; the only auth feature is forwarding the HF user token to hf.co/mcp. No OAuth client flow. - **Callback URL(s):** none published Setup (owner runs these on the machine running JUJU): ```bash ``` Caveats: JUJU's OAuth challenge cannot be completed; would need an unauthenticated or header-based path. Sources: - https://huggingface.co/docs/chat-ui/configuration/mcp-tools - https://raw.githubusercontent.com/huggingface/chat-ui/main/README.md ### Cohere North — custom MCP servers via north-mcp-python-sdk - **Can connect:** ❌ no (confidence medium) - **Plans:** Developer/admin integration; no end-user add UI documented. - **Auth:** North sends an X-North-ID-Token header; StreamableHTTP only; no OAuth 2.1 authorization-code flow against the server's own AS. - **Callback URL(s):** none published Setup (owner runs these on the machine running JUJU): ```bash ``` Caveats: Would require JUJU to validate North-issued ID tokens instead of its own OAuth — not supported today. Sources: - https://raw.githubusercontent.com/cohere-ai/north-mcp-python-sdk/main/README.md ### Manus — Settings → Integrations → Custom MCP Servers - **Can connect:** ❌ no (confidence medium) - **Plans:** Not stated. - **Auth:** HTTPS URL + 'API key, Bearer token, or other credentials' (pasted OAuth token allowed); no browser authorization-code flow documented. - **Callback URL(s):** none published Setup (owner runs these on the machine running JUJU): ```bash ``` Caveats: No auth-code flow → JUJU's OAuth cannot be completed unless JUJU issues a long-lived bearer token out of band (not a documented JUJU feature). Sources: - https://manus.im/docs/integrations/custom-mcp ### Codex web (chatgpt.com/codex), Kimi web (kimi.com), Qwen Chat web, Poe, You.com, DeepSeek web - **Can connect:** ❌ no (confidence medium) - **Plans:** N/A — no evidence of an end-user MCP client on the web surface. - **Auth:** N/A. Codex: 'The ChatGPT desktop app, Codex CLI, and IDE extension support MCP servers' and 'ChatGPT web doesn't read local Codex configuration files'; the Codex cloud page has no MCP section. Kimi: only Kimi Code CLI/VS Code and API Playground document MCP. Qwen: 'MCP connection in Qwen is only available in Desktop apps' (third-party, Dec 2025). Poe/You.com/DeepSeek: no official MCP-client docs found (You.com offers an MCP server, not a client). - **Callback URL(s):** none published Setup (owner runs these on the machine running JUJU): ```bash ``` Caveats: 'No evidence found' as of 2026-09-09, not a confirmed official 'unsupported' statement for Poe/You.com/DeepSeek. Kimi Code CLI (not web) supports `kimi mcp add --transport http --auth oauth` per the moonshotai mirror docs. Sources: - https://learn.chatgpt.com/docs/extend/mcp?surface=cli - https://learn.chatgpt.com/docs/cloud - https://netsuite.folio3.com/blog/connecting-mcp-tools-with-qwen/ - https://moonshotai.github.io/kimi-cli/en/customization/mcp.html - https://you.com/docs/build-with-agents/mcp-server ## JUJU-side facts checked locally after the research (2026-09-09) The researchers were given a one-paragraph profile of JUJU, not the code, so some "gaps" below are about that profile rather than the product. Checked against the published `juju-mcp` build on a loopback server with a fake public host: - **Tool annotations: already complete.** All 43 tools declare `readOnlyHint` and `destructiveHint` (23 read-only, 14 destructive); no tool name exceeds 64 characters. The "annotations" gap below does not apply. - **RFC 9207: now advertised** (commit 4fe2d2d) and `iss` is present on success and error redirects (test AUTH-21). - **Unknown authorize query parameters are ignored** (`actor=user`, `prompt=consent` → normal 303 to the consent page), as Perplexity needs. - **A missing `resource` parameter is accepted at `/auth`** (303 to consent). Token issuance without `resource` was not exercised; if a client omits it and the token step fails, that is the place to look. - **Extra scopes need care.** `/auth` accepts `openid profile` alongside `juju:read` (303 to the consent page), but a live ChatGPT attempt on 2026-09-09 showed that ChatGPT sends `openid` with the JUJU scopes and that, before the fix tracked in ADR-016, the consent adapter dropped `openid` from the grant, so oidc-provider bounced the browser into a second consent interaction instead of returning a code. The fix (grant `openid` at the OIDC level only when requested; resource scopes stay JUJU-only) is being made in a separate session and is not yet committed as of this note. - **Discovery placement:** protected-resource metadata is served at the path-inserted URL `/.well-known/oauth-protected-resource/mcp` (and that URL is what the 401 `WWW-Authenticate` header points to); the root form `/.well-known/oauth-protected-resource` returns 404. Clients that only try the root form (Amazon Quick's fallback) would need that added. `/.well-known/oauth-authorization-server` and `/.well-known/openid-configuration` both answer. - **Consent page behaviour matches what the clients expect:** `/auth` answers immediately with a 303 to a self-contained page that polls for the owner's `juju auth approve`, then redirects to the registered callback with `code`, `state` and `iss` (303). Approve promptly: Claude.ai has been observed restarting the flow after roughly 30 seconds; if two pending requests appear, approve the one whose phrase matches the page currently open. - **No MCP `instructions` field** is set on the server object today (minor; the tool descriptions and `project_overview` carry the guidance). ## Gaps in JUJU surfaced by this research | Gap | Affects | Effort | Recommendation | |---|---|---|---| | No RFC 7591 Dynamic Client Registration endpoint | Notion Custom Agents (hard block: 'the MCP server can't be used'), Replit Agent (only DCR auto-registration documented), Mistral Le Chat default/auto-detect path (static path only third-party-evidenced), Zapier MCP Client and Make MCP Client (unknown; may be DCR-only), Every other product: forces the owner to run juju auth add-client per client and per callback URL | medium | Add an optional, rate-limited RFC 7591 registration_endpoint that issues a client_secret (Microsoft's DCR path and Perplexity's 2026 bug both expect a secret for confidential registrations; also return public registrations when token_endpoint_auth_method=none is requested) with an owner-approval or allowlist gate so it does not reopen the 'anyone can register' problem. Note the MCP spec 2026-07-28 deprecates DCR in favour of CIMD — implement CIMD too (see next gap). | | No Client ID Metadata Document (CIMD) support (client_id_metadata_document_supported + 'none' in token_endpoint_auth_methods_supported) | Claude.ai (would let users pick 'Use Anthropic's hosted client metadata' with zero owner setup), ChatGPT (prefers CIMD over DCR; client.json / per-callback client.json), Gemini Spark (presents a CIMD-style client_id on accountlinking.google.com), Any future client following MCP spec 2026-07-28 | medium | Implement CIMD: accept https client_id URLs on an owner-configurable allowlist (chatgpt.com/oauth/*, claude.ai, accountlinking.google.com), fetch and validate the metadata document (redirect_uris, jwks), support token auth 'none' and private_key_jwt. This removes the per-callback pre-registration step for the biggest clients while keeping the owner allowlist. | | No RFC 9207 issuer identification (authorization_response_iss_parameter_supported + iss on every authorization response) | ChatGPT web (uses per-connection https://chatgpt.com/connector/oauth/{callback_id} instead of the stable https://chatgpt.com/connector_platform_oauth_redirect, so the owner must create the app first and copy the callback before Scan Tools) | small | Advertise authorization_response_iss_parameter_supported:true in RFC 8414 metadata, keep the issuer string byte-identical between metadata and the RFC 9728 authorization_servers list, and append iss= to every success and error redirect. Then ChatGPT uses the stable redirect URI, which can be pre-registered once. | | Consent is terminal-only (juju auth pending / approve) while every web client expects a browser-driven authorize page that ends in a redirect within a client-side timeout | All products — Claude re-issues GET /authorize with fresh state ~28–47 s after the first if not completed (issue #899), Gemini Spark (one report of abandoning after the 302 with no /token call), Mistral (≈10-minute auth-URL TTL in Studio/Workflows), ChatGPT, Perplexity, Copilot, Grok, Cursor, Devin, Slack (timeouts undocumented) | medium | Make /authorize return an HTML page immediately (never hold the HTTP response), poll for approval, bind the code to the most recent state/PKCE pair, redirect with 302 (not 303 — Spark stalled on 303), and show a countdown/instructions. Add an optional owner-configurable in-browser approval (authenticated owner session or one-time approval link) or a device-code style flow so approval does not depend on a live terminal; keep the terminal path as the default secure mode. | | Tools lack readOnlyHint / destructiveHint annotations | ChatGPT (tools without readOnlyHint are treated as write actions and prompt every conversation), Claude.ai (docs require both hints; read-only tools then run without per-call confirmation), Microsoft Cowork plugins (unannotated tools are treated as destructive), Gemini Spark (write actions need manual confirmation) | small | Annotate all 43 tools: readOnlyHint:true on read/search/semantic/list/git-status tools; destructiveHint:true on edit/delete/run/git-write tools; keep names ≤64 chars. Also add a self-contained MCP `instructions` field (first 512 chars) and action-oriented descriptions for ChatGPT's tool selection. | | No tools named search / fetch (read-only retrieval pair) and no read-only tool profile | ChatGPT Deep research (read/fetch actions only) and company knowledge (only apps with search/fetch), Microsoft 365 Copilot custom federated connectors (expect read-only tools such as search, fetch, query), ChatGPT Pro accounts if the Help Center's 'read/fetch only' rule applies | small | Add `search` (query → list of {id,title,url}) and `fetch` (id → document) tools wrapping JUJU's existing read/semantic-search tools, and add a per-client 'read-only tool profile' flag so an admin can expose only readOnlyHint tools to surfaces that demand it. | | Strictness of the AS against non-conforming clients: requiring the RFC 8707 resource parameter, rejecting unknown authorize query params, rejecting unknown scopes, and mandating PKCE for confidential clients | Mistral (sends no resource/audience; requests scope offline_access + grant refresh_token), Gemini Spark and Gemini Enterprise (resource behaviour undocumented), Perplexity (appends actor=user to the authorize URL), Copilot Studio Manual OAuth (may omit code_challenge; secret required), ChatGPT (requests every advertised OIDC scope) | small | Make `resource` optional (default audience = the canonical /mcp URL when absent), ignore unknown query parameters, treat unknown/offline_access scopes leniently (grant refresh tokens), add a per-client `--pkce optional` switch for confidential clients, accept both client_secret_basic and client_secret_post, and advertise only scopes JUJU actually issues in scopes_supported. | | AS/PRM metadata completeness and placement not guaranteed for every discovery style | ChatGPT ('MCP servers are unsupported' without code_challenge_methods_supported S256; wants token_endpoint_auth_methods_supported), Claude.ai (PRM resource must equal the typed URL exactly; 10 s latency limits on discovery/token), Amazon Quick (no path-insertion discovery — needs /.well-known/oauth-protected-resource at the origin root and scopes_supported), Perplexity and Gemini Enterprise (only /.well-known/oauth-authorization-server typed/used) | small | Serve RFC 9728 PRM at both the root path and the /mcp path-inserted path, include scopes_supported and authorization_servers, and in RFC 8414 metadata publish code_challenge_methods_supported ['S256'], token_endpoint_auth_methods_supported ['none','client_secret_basic','client_secret_post'], grant_types_supported incl. refresh_token, and answer discovery/token in well under 10 s. | | No configurable access-token lifetime / refresh-token policy per client | Copilot Studio Manual OAuth (reported never to call the refresh endpoint → users must reconnect on expiry), ChatGPT and Claude (refresh tokens recommended; Claude expects rotation + invalid_grant for dead refresh tokens) | small | Issue refresh tokens by default with rotation for public clients and RFC 6749 invalid_grant on reuse, and add per-client access-token TTL so the Copilot Studio client can get long-lived access tokens. | | Transport coverage: Streamable HTTP only (405 on GET/DELETE); legacy HTTP+SSE not offered as a named /sse endpoint | Make MCP Client (verified list is SSE-suffixed) and Zapier SSE option (both minor), Clients that open a standalone GET SSE stream (ChatGPT/Perplexity behaviour undocumented) | medium | Low priority: Streamable HTTP is accepted or required by every major product (Copilot Studio, Gemini Enterprise, Slack, Cursor cloud reject SSE). Optionally return 200 with an event-stream on GET /mcp (spec-permitted) instead of 405 to be safe with clients that probe GET, and document that the '2025-era stateless legacy path' is not the deprecated HTTP+SSE transport. | | Only public HTTPS deployments are supported; no built-in outbound tunnel story for the same-origin AS | All products (Claude requires IPv4 A record reachable from 160.79.104.0/21; Grok rejects private IPs; ChatGPT's Secure MCP Tunnel does not tunnel the AS) | small | Document a reference deployment (reverse proxy with public-CA TLS, no cross-host redirects, WAF allowlists for OpenAI/Anthropic/Perplexity egress, lenient Origin validation) and note that /authorize and /token must be reachable by the user's browser even when /mcp is tunneled. | ## Unverified claims (do not rely on these) - ChatGPT: write-tool (full MCP) availability on Plus and Pro plans — OpenAI's developer-mode guide (Pro/Plus/Business/Enterprise/Edu full read/write) and Help Center (≈2026-08-21: Business/Enterprise/Edu only; Pro read/fetch only; Plus not mentioned) conflict; unresolved. - ChatGPT: exact current dialog field labels ('OAuth Client ID' / 'OAuth client secret', 'Registration Method → User-defined OAuth client') and that the per-connection callback URL is visible under Advanced settings → Callback URL before Create — evidenced only by a Salesforce guide and community threads, not OpenAI pages. - ChatGPT: whether it issues GET/DELETE to /mcp and tolerates 405; whether there is a timeout on the browser authorization step; the sentence 'Some especially risky actions may be blocked' and the 'frozen tool snapshot' wording were not found on official pages; 'offline_access' is nowhere in OpenAI docs (refresh tokens only generically recommended). - ChatGPT: the exact admin toggle path 'Workspace Settings → Permissions & Roles → Connected Data Developer mode / Create custom MCP connectors' is not verbatim on any fetched page; the July 9 2026 'Plugins' directory migration date is from a third-party blog. - Claude.ai: which token-endpoint client-authentication method (client_secret_basic vs client_secret_post) Claude uses for a confidential pre-registered client; whether Claude invalidates the earlier state when it re-issues /authorize after ~28–47 s (issue #899, no maintainer reply); whether Claude opens a GET SSE stream on /mcp; the 'https://claude.com/api/mcp/auth_callback' variant (third-party only); issue #344 (client ID/secret appearing blank after Add) unresolved. - Claude.ai: the dead support article 11503834 quote 'Claude supports Dynamic Client Registration (DCR).' is unverifiable (HTTP 404). - Gemini Spark: the exact Google-hosted redirect URI (expected on oauth-redirect*.googleusercontent.com, format https://oauth-redirect.googleusercontent.com/r/) — must be copied from the 'Copy Redirect URL' button; https://gemini.google.com/oauth-redirect was a misread and is NOT verified. - Gemini Spark: PKCE S256, RFC 9728/8414 discovery and the 302-vs-303 sensitivity are community-observed only (not Google-documented); RFC 8707 resource behaviour unknown; acceptance of a public PKCE-only (secret-less) client unknown; the Aug 6 2026 stall (302 sent, /token never called) is unresolved; authorize-step timeout undocumented; transport (Streamable HTTP vs legacy SSE) not named on the help page. - Gemini Enterprise Business edition redirect URI: not published (unknown). Gemini Code Assist edition gating for MCP: not stated. - Mistral: the production redirect URI https://callback.mistral.ai/v1/integrations_auth/oauth2_callback comes from a single third-party capture (2026-03-03) — unofficial; the static Client ID/Secret path in the chat UI is evidenced only by Tredict and Qlik guides, not Mistral docs; Mistral's PKCE use, client_secret_basic, offline_access and absence of resource/audience are from that same single capture and may have changed; chat-UI authorization timeout undocumented; whether public (secret-less) clients work is unproven; no maximum tool count documented (43 tools 'should be listable' is inference); the sweep verifier's 'Le Chat is DCR only' conflicts with the dedicated Mistral verification. - Perplexity: RFC 9728 protected-resource metadata / WWW-Authenticate-driven discovery and RFC 8707 resource indicators unverified; the create-time probe being 'POST /mcp initialize' and 405-on-GET tolerance are from a third-party README; handling of a 43-tool server unknown; Free-plan exclusion is third-party only; Comet Assistant/sidebar custom-connector support has no official statement (third-party says catalog-only); the consumer 'Local and Remote MCPs' help article's current wording is unknown (post-March-2026 captures are Cloudflare challenge pages); the Aug 24 2026 'Always ask' feature is from a third-party changelog mirror. - Microsoft Copilot Studio: PKCE S256 support for the Manual/generic OAuth 2 connector is undocumented (Power Platform forum thread says code_challenge is omitted, unanswered; 2026 third-party blogs conflict); refresh-token behaviour (Q&A 5922525: /token never called on expiry) unresolved; tool-count limit for the standard harness not established; RFC 8707 / runtime WWW-Authenticate / RFC 9728 handling undocumented for all Microsoft surfaces; Microsoft-side authorization timeout undocumented; techcommunity blog 4460822 body unreadable (supplemental only). - Microsoft: the exact Copilot Studio per-connector callback URL is only revealed after Create (pattern https://global.consent.azure-apim.net/redirect/ from a Microsoft-hosted blog and an official sample); the bare global redirect URI is legacy and should not be relied on. - Grok: the OAuth credential screen (Client ID, blank secret, 'none (PKCE only)', PKCE S256, auto-discovered endpoints) and the callback https://grok.com/connectors-oauth-exchange-code/ are documented only by third-party vendor guides (pearmcp.com, flashalpha.com), not docs.x.ai; the May 6 2026 launch date is from a search snippet; RFC 8707 unknown. - Devin: acceptance of a public (secret-less) client, discovery details, RFC 8707 and plan tier not stated. Cursor Cloud Agents: RFC 8707 and consent timeout not stated. Slack: whether the Manual OAuth 'identity endpoint' requires a userinfo-style endpoint from JUJU is unverified. - Amazon Quick: exact callback URI not on the doc page. Glean: callback URI, PKCE and resource-indicator behaviour not on the fetched page; single source, low confidence. - Zapier MCP Client and Make MCP Client: whether OAuth is DCR-only or accepts a pre-registered client is undocumented; Make plan requirement conflicts (open beta to all users vs all paid plans); Make Streamable HTTP acceptance for manual URLs not confirmed. - Salesforce Agentforce Registry: help-article body could not be retrieved (TOC only) — callback URL, credential fields, PKCE, DCR-vs-static and 'Beta' status all unverified; the generic Salesforce authcallback pattern in the setup commands is an assumption. - Sweep negatives: Poe, You.com, DeepSeek web have no official MCP-client documentation found (absence of evidence, not an official 'unsupported' statement); Qwen Chat 'desktop apps only' is from a Dec 2025 third-party blog; the Kimi quote 'kimi mcp add --transport http --auth oauth' exists on the moonshotai mirror, not on kimi.com. - JUJU-side assumptions used throughout: that JUJU's RFC 8414 metadata already advertises code_challenge_methods_supported ['S256'] and token_endpoint_auth_methods_supported, that its /authorize page can hold a browser session while the terminal approval runs, and that its PRM is served at the origin root — none were verified against the JUJU codebase in this task (no files were read or modified).