docs: MCP page describes the hosted server at mcp.affitor.com

[sonpiaz]

What

The MCP page described the old stdio server while the hosted server (serverInfo.websiteUrl) points here. It now documents https://mcp.affitor.com/mcp: OAuth sign-in and consent screen, per-client install, the 12 read-only tools (7 brand, 5 partner), example prompts, limits and security, removing access, troubleshooting, and a short legacy section for @affitor/mcp (still on npm). New changelog entry hosted-mcp-server; agent-integration Related line and mcp-write-tools-off link updated. llms-full.txt is generated at build (20 mentions of mcp.affitor.com after build).

Install lines: run vs format-checked

Client	Line	Status
Claude Code	claude mcp add --transport http affitor https://mcp.affitor.com/mcp	RUN (isolated CLAUDE_CONFIG_DIR, 2.1.301): added; claude mcp get = "Needs authentication", type http. /mcp sign-in not run
Codex	codex mcp add affitor --url … (+ codex mcp login affitor)	RUN end to end (see incident): OAuth via DCR + loopback, "Successfully logged in". Codex logged "OAuth provider rejected discovered scopes. Retrying without scopes" first
Gemini CLI	gemini mcp add --transport http affitor … then /mcp auth affitor	add RUN (0.46.0, project settings shows url + type http); auth format-checked (geminicli.com/docs/tools/mcp-server)
Cursor	JSON + deeplink config=eyJ1cmwiOiJodHRwczovL21jcC5hZmZpdG9yLmNvbS9tY3AifQ%3D%3D	format-checked (cursor.com/docs/context/mcp/install-links; same as dashboard cursorDeeplink)
OpenClaw	openclaw mcp add affitor --url … --transport streamable-http --auth oauth + openclaw mcp login affitor	format-checked against installed CLI help (2026.6.11); not run (add probes server, could open browser)
Hermes	hermes mcp add affitor --url … --auth oauth, hermes mcp login affitor	format-checked against installed CLI help (v0.21.0); default OAuth redirect is loopback (tools/mcp_oauth.py:38)
Claude (claude.ai/Desktop)	Customize › Connectors › + Add › Add custom connector; OAuth client "Register automatically"	format-checked (support.claude.com/en/articles/11175166)
ChatGPT	chatgpt.com/plugins › + › Add custom MCP server › … › Create as a plugin	format-checked (developers.openai.com/apps-sdk/deploy/connect-chatgpt); the OpenAI help article returned 403
Other	{"mcpServers":{"affitor":{"url":…}}}	copied from dashboard ConnectSheet; not run
Dropped (do not work per code, or unverified): VS Code (see bug 1), Grok, Perplexity, Le Chat, Gemini app, Manus (their web redirect hosts are not on the allowlist), Goose deeplink and npx add-mcp (brief marked [I], not verified).

Product bugs and mismatches found (no product code changed)

1. VS Code cannot connect. VS Code's DCR sends redirect_uris [https://insiders.vscode.dev/redirect, https://vscode.dev/redirect, http://127.0.0.1/, http://127.0.0.1:33418/] (microsoft/vscode src/vs/base/common/oauth.ts:959-968). areAllowedRedirectUris requires every URI allowed (affiliate-cms src/mcp/redirect-allowlist.ts:35-37, vscode hosts absent at :9-14). Measured: POST https://mcp.affitor.com/oauth/reg with that shape → 400 invalid_redirect_uri (no client created). The page says VS Code cannot connect.
2. Same allowlist blocks web clients the brief lists as "paste URL" (Grok, Perplexity, Le Chat, Gemini app, Manus). Brief §3.3 last line is wrong for today's server.
3. DCR rejection message is misleading: "redirect_uri did not match any of the client's registered redirect_uris" for a registration-time allowlist refusal.
4. Dashboard ConnectSheet Claude steps say "Settings → Connectors" (affiliate-dashboard src/components/AffiliateManagement/Mcp/ConnectSheet.tsx:81-82); Claude's current help says Customize › Connectors › + Add › Add custom connector. Docs follow Claude's help.
5. ConnectSheet still hides ChatGPT ("until the hosted server is published", ConnectSheet.tsx:12-16) although chatgpt.com is allowlisted and the server is live. Docs include ChatGPT (format-checked only).
6. AS metadata lists openid in scopes_supported while only read is granted (provider.ts:92 comment); Codex first got "rejected discovered scopes" and retried. Cosmetic but visible.
7. Registry entry com.affitor/mcp 0.2.2 is stdio only, remotes absent, websiteUrl https://affitor.com (curl registry.modelcontextprotocol.io/v0.1/servers?search=affitor).
8. Blog content/blog/agent-commerce-attribution-layer.mdx:111 links the MCP page for "the seven tools and the readiness loop" (now the legacy section). Not edited (blog out of scope). Brand tracking pages (testing-integration.mdx:24, quickstart-integration.mdx:41) mention the legacy affitor_run_verification tool without a link; left as is.
9. Still true from the brief: x-powered-by: Strapi on /mcp, error="invalid_request" on a bare request.

Sources (claim → evidence)

Probes (16/10 ~16:57 PT, curl):

• PRM at /.well-known/oauth-protected-resource and /mcp: 200, resource https://mcp.affitor.com/mcp, AS https://mcp.affitor.com/oauth, scopes ["read"].
• AS metadata /.well-known/oauth-authorization-server/oauth: S256 only, registration_endpoint, revocation_endpoint, token_endpoint_auth_methods_supported: ["none"], no CIMD field.
• Unauthenticated POST /mcp: 401, WWW-Authenticate: Bearer resource_metadata="…/oauth-protected-resource/mcp", scope="read", error="invalid_request".
• POST /mcp with Bearer aff_live_xxx: 401 "Program API keys are not accepted here".
• Prod dashboard JS contains "wants to access Affitor", "As a partner", "All programs you are a partner in.", "Remove access any time in Settings." (pages/oauth/consent-a4369353f667c074.js); label:"AI agents" (chunk 9417); "Add custom connector", "codex mcp login affitor", "Call get_program and check that its id is", panel descriptions (chunk 9707).
• npm @affitor/mcp latest 0.2.2, not deprecated, repo Affitor/cli.

affiliate-cms origin/main 0f7bbaa0:

• Tools, inputs, descriptions, grants: src/mcp/tools/defs.ts get_program 114-139, list_partners 140-145, get_partner 146-151, list_applications 152-161, list_commissions 162-167, get_commission_summary 168-177, get_billing 178-199, list_my_programs 200-212, list_my_links 213-226, get_my_earnings 227-239, list_my_commissions 240-245, list_my_payouts 246-255 ("Bank and PayPal details are never included" 248); money/window/paging 94-97, Window 27-30, Page 31-34, CommissionWindow 79-82, statuses 24, limit 1-50 22; annotations 258; per-grant set 260.
• Grant-only registration and refusal: src/mcp/tools/index.ts:61-72, src/mcp/http.ts:106-119; errors "Not found." / "Too many rows…" / "Something went wrong." tools/index.ts:15-17; structuredContent + text tools/index.ts:51.
• Data notice + 280-char cut + truncated: src/mcp/tools/gate.ts:11-16,20-37.
• Server instructions (read-only, one program, money units, dates, url, get_program snippet): src/mcp/server-info.ts:17-24; websiteUrl :10; version 0.1.2 :9.
• Auth: token refusal by prefix http.ts:49-54; audience check :63-64; revoked/allowed per call :65-71; rate limit 429 :90-94; scope read only :187-191; consent bad message :151-155; redirect to consent page :148.
• Access per call: src/mcp/access.ts:13-48.
• Rate limits: src/mcp/rate-limit.ts:33-39 (mcp 120/min/connection, token 60/min/client, 600/min global, reg 300/h).
• Token lifetimes: src/mcp/provider.ts:71 (AT 3600, audience), :100-109 (rotating RT 30 d, Interaction 600 s), PKCE S256 :93, DCR :62, revocation :61.
• Consent assertion 2 min, single use: src/mcp/consent-assertion.ts:19, http.ts:165-170.
• Redirect allowlist + loopback label: src/mcp/redirect-allowlist.ts:9-49.
• Remove (tokens destroyed first, owner may remove brand rows): src/api/mcp-connection/controllers/mcp-connection.ts:34-38,127-144.
• Audit fields, never args/output: src/mcp/tools/audit.ts:1-25; 30-day purge src/mcp/cleanup.ts:24.

affiliate-dashboard origin/main 0b3d39dd:

• ConnectSheet tabs, steps, install prompt, "Connect an AI tool", "Sign in with your Affitor account. No key needed.": src/components/AffiliateManagement/Mcp/ConnectSheet.tsx:16-22,67-119,142,181.
• Consent page labels (title, Unverified, Signed in as/Switch, As a brand/As a partner, Program/Programs, Access Read-only + descriptions, Cancel/Allow, Nothing to connect yet, This request has expired): src/pages/oauth/consent.tsx:33-36,212-214,230-325.
• Client marks verified by redirect host only: src/components/AffiliateManagement/Mcp/clients.ts:7-26.
• Panel "Affitor MCP", Connections columns, Remove, owner rule, "loses access … right away": src/components/AffiliateManagement/Mcp/McpPanel.tsx:21-24,41-42,87-171.
• Brand nav Developers › AI agents: src/config/settingsNav.ts:108-113; All settings in program menu src/components/AffiliateManagement/Advertiser/shell/ProgramMenu.tsx:294.
• Partner Settings › Integrations: src/pages/partner/profile.tsx:290-295,1099; Settings label Partner/AffiliateLayout.tsx:215.
• Tracking step Your agent / Connect your AI: src/components/AffiliateManagement/Advertiser/Setup/TrackingStep.tsx:17,192-205.

Legacy server: affiliate-cli origin/main b886c60 packages/mcp/package.json (0.2.2, stdio) and packages/mcp/src/index.ts:200-457 (tool names, AFFITOR_MCP_WRITE); plugin claude-plugins origin/main plugins/affitor/.mcp.json.

Client docs: code.claude.com/docs/en/mcp · learn.chatgpt.com/docs/extend/mcp?surface=cli · geminicli.com/docs/tools/mcp-server · cursor.com/docs/context/mcp/install-links · support.claude.com/en/articles/11175166 · developers.openai.com/apps-sdk/deploy/connect-chatgpt · installed openclaw mcp add --help, hermes mcp add --help · github.com/microsoft/vscode src/vs/base/common/oauth.ts.

No money or terms wording. No media.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
affitor-docs	Ready	Preview	Oct 17, 2026 12:11am UTC