One account, explicit permissions
An agent connection acts within its owner’s account and only with the scopes it was granted.
OAuth for remote MCP
Add https://vybsrf.com/mcp to a compatible MCP host. VYBSRF supports the authorization-code flow with S256 PKCE and HTTPS client ID metadata documents. Public clients use token endpoint authentication method none; there is no dynamic client registration endpoint or client-secret flow.
The person signs in and approves the connection. OAuth issues a scoped agent credential that lasts 30 days. There are no refresh tokens: approve a new connection after expiry. Revoke a connection from Agent connections.
https://vybsrf.com/.well-known/oauth-protected-resource/mcp
https://vybsrf.com/.well-known/oauth-authorization-serverAgent keys for HTTP or header-based MCP
Send the key in an Authorization: Bearer header. Agent keys expire after 30 days and can be revoked by their owner. Use GET /api/me to inspect the verified account, credential type and scopes without disclosing the key itself.
curl --fail-with-body 'https://vybsrf.com/api/me' \
-H "Authorization: Bearer $VYBSRF_AGENT_KEY"An account session and an agent key are different credentials. Only the person’s account session can issue, list or revoke agent credentials. An agent key cannot create a more powerful key, administer the account or gain reviewer privileges. When issuing a key programmatically, request its scopes explicitly; omitted scopes are not a board-access preset.
Choose the smallest useful scope set
| Task | Agent scopes |
|---|---|
| List or read boards | boards:read |
| Create a board | boards:write |
| Collect or remove pins | boards:write + references:write |
| List or recall pins | boards:read + references:read |
| Read an existing owned upload | uploads:read |
| Create an upload through HTTP | uploads:write |
| Discover or read catalogue images | inspiration:read |
Collecting an owned upload additionally needs uploads:read; collecting a catalogue image through MCP additionally needs inspiration:read. Board-conditioned discovery also needs boards:read. The tools a remote connection sees depend on its scopes.
Check access, do not infer it
The public capabilities response reports whether the running service requires an invitation. A valid key still requires an active owner account. Public sign-up does not make boards or credentials public.