Market-intelligence startup, co-founder
MCP Server with OAuth 2.1
A production Model Context Protocol server that lets subscribers plug a fintech data platform into Claude, ChatGPT, or their own agents: 21 curated research tools behind a standards-compliant OAuth 2.1 authorization server.
- Headline number
- 21 tools behind OAuth 2.1
- Role
- Architected and built
- Category
- AI Agents & Runtimes
- Updated
Architecture
- AI hostClaude, ChatGPT, agents
- Edge WAFrate ceiling per address
- OAuth 2.1 serverPKCE, DCR, revocationMCP endpointJSON-RPC
- Bearer guardmember, grant, plan
- Tool registry21 tools, typed hints
- Shared data functions
Key takeaways
- 21 tools, 19 read-only and 2 writes, every one declaring its read-only, destructive, and open-world hints
- OAuth 2.1 with PKCE only, dynamic client registration, discovery, resource indicators, rotating refresh tokens, and revocation
- Limits keyed per member rather than per IP, because AI hosts share egress addresses
- A lapsed plan, password change, or revocation cuts access within 60 seconds
The situation
Members increasingly do research inside an AI assistant. The platform needed to meet them there, with the same data the site serves, without creating a second security model or a tool surface nobody maintains.
What I built
A stateless Streamable HTTP MCP endpoint inside the web app, with a tool registry of 21 curated research tools over the same data functions the site uses. Each tool declares its safety hints and the type system refuses one that does not. Every result carries an as-of timestamp and an educational disclaimer. The documentation page renders from the registry, so it cannot describe a tool that does not exist.
The authorization server is the larger piece: OAuth 2.1 with PKCE S256 only, dynamic client registration, discovery metadata, resource indicators, rotating refresh tokens with reuse detection, and revocation. Codes and tokens are stored only as SHA-256 hashes. A bearer guard re-checks the member, the grant, and the plan on every call with a 60-second cache. Rate limits are per member at 120 a minute and 3,000 a day, with an edge WAF ceiling per address above that.
The outcome
Subscribers connect Claude, ChatGPT, or Claude Code to their account in one consent flow and research with the platform's tools inside their assistant. Plan changes and revocations take effect in under a minute.
Stack
Related work
Same discipline, different system.
Need this built inside your organization?
One person, architecture to deployment. Tell me what is stuck and I will tell you where I would start.