capybaraConnect an AI assistant with MCP
Endpoint discovery, registration, consent and tool boundaries.
Reviewed October 22, 2026
Discover the MCP resource
The hosted endpoint is https://app.cpbr.link/api/mcp, using stateless Streamable HTTP. Resource metadata is at https://app.cpbr.link/.well-known/oauth-protected-resource/api/mcp. For another instance, use its own discovery metadata and canonical HTTPS origin. Availability is independent of the JSON API.
Register and authorize the client
A compatible client needs operator registration with its actual callback URI and allowed scopes. Automatic public registration is disabled. Use OAuth with S256 PKCE and the exact MCP resource audience; an API-audience token is not an MCP token. The user signs in, completes security checks and explicitly approves permissions. Native clients use registered literal-loopback or supported native callbacks.
Use tools deliberately
Tools support owner-scoped links, page drafts/blocks/history/publication, simulation store orders, connection revocation and supported subscription payment reads/sandbox actions. Fetch page/block schemas on demand. Confirm writes, publication, deletion, fulfillment and revocation with the user. Use required idempotency and revision fields.
Keep boundaries explicit
Real payment creation remains disabled through MCP/API. Domain purchases and administrative settings have no tool. Existing grants are not expanded automatically when new scopes appear. Reauthorize the appropriate registered client when needed, and revoke unused connections. See the live reference for current tools and errors.