Any MCP client
Only Claude Desktop and Claude Code are tested. Another client may work if it meets the requirements below. It is not supported, and Fedwright can’t promise it will keep working.
What the client needs
Section titled “What the client needs”| Setting | Value |
|---|---|
| Server URL | https://mcp-staging.fedwright.com/mcp |
| Transport | Streamable HTTP. The server keeps no session between requests. |
| Authorization | OAuth authorization code flow with PKCE, found by discovery |
| Client ID | A pre-registered public client’s ID, from the list below |
| Client secret | None |
| Token | Authorization: Bearer ACCESS_TOKEN on every request |
Each client needs a Fedwright-registered client ID. These are registered in this environment:
| Client | Client ID | Redirect |
|---|---|---|
| Claude Code | 396252832577093860 |
Loopback, port 33418 |
| Claude | 394944800756858905 |
The client’s own |
A client that can’t use a pre-registered client ID, or that has to register itself, can’t connect yet. Fedwright doesn’t accept self-registered clients.
OAuth discovery
Section titled “OAuth discovery”A client that calls the server without a token gets 401 with a WWW-Authenticate header that
points to the server’s protected-resource metadata and names the scope to request:
HTTP/1.1 401 UnauthorizedWWW-Authenticate: Bearer resource_metadata="https://MCP_HOST/.well-known/oauth-protected-resource", scope="SCOPES"The metadata (RFC 9728) names the authorization server and the scopes. It is public:
curl -sS https://mcp-staging.fedwright.com/.well-known/oauth-protected-resourceThe client then reads the authorization server’s own discovery document, at
/.well-known/openid-configuration on https://auth-staging.fedwright.com, signs the user in, and
requests the scopes the metadata lists. Send the returned access token with each MCP request.
After sign-in
Section titled “After sign-in”A signed-in client still needs the user’s approval for one organization. The first tool call that needs data returns an error whose text holds an approval link, as in the overview. A client on MCP revision 2026-07-28 or later that supports URL elicitation gets a request to open the link instead of error text. After the user approves, call the tool again.