skills.rest
FriendsOfREDAXO
FriendsOfREDAXOOFFICIAL
Explore all skills by this author →
WebsiteGitHub

ai-platform-mcp

Documents the MCP server and OAuth 2.1 architecture of the REDAXO ai_platform addon.

4|Updated May 27, 2026
Search Tags:#authentication#api#oauth#mcp#claude desktop#pkce#redaxo
One-click install
npx skills add https://github.com/FriendsOfREDAXO/ai_platform --skill ai-platform-mcp-friendsofredaxo
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ai-platform-mcp
Source: https://github.com/FriendsOfREDAXO/ai_platform/tree/main/.claude/skills/ai-platform-mcp
Command: npx skills add https://github.com/FriendsOfREDAXO/ai_platform --skill ai-platform-mcp-friendsofredaxo

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Developers working on the REDAXO ai_platform addon need accurate knowledge of its MCP server routing, tool registration, scope system, and the fully implemented OAuth 2.1 layer (PKCE, refresh rotation, DCR) to add routes, register tools, or debug remote clients like Claude Desktop without rediscovering known pitfalls. ## Core Features & Use Cases - MCP Architecture Reference: Documents live routes (/mcp, /oauth/*, discovery endpoints), config keys, class topology (Router, Server, Authenticator, Context, Tool), and tool registration with scope-based visibility. - OAuth 2.1 Internals: Covers authorization code + PKCE (S256-only), refresh token rotation with replay protection, Dynamic Client Registration, and the YCom group-to-scope mapping tables. - Remote Client Debugging Playbook: Eleven hard-won lessons for connecting Claude Desktop via ngrok, including baseUrl derivation, arg_separator pitfalls, DCR client_secret_post support, and the ngrok inspector workflow. - Use Case: When a protected tool does not appear in Claude Desktop's tool list, consult the skill to learn about the chicken-and-egg 401 problem and enable mcp_require_auth so OAuth login is triggered. ## Quick Start Ask the assistant to explain how to register a new scope-protected MCP tool in the ai_platform addon and why it might not appear for anonymous callers.

Frequently Asked Questions about ai-platform-mcp

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I register a new MCP tool in the REDAXO ai_platform addon?▼

Create a FriendsOfRedaxo\AiPlatform\Mcp\Tool instance with name, description, inputSchema, and a handler receiving arguments and a Context object. Set public to true for anonymous access or define requiredScopes so only authenticated users with matching YCom group scopes can call it.

Why don't protected MCP tools appear in Claude Desktop?▼

MCP clients only start OAuth when they receive a 401, but anonymous 200 responses for public tools mean Claude connects anonymously and never sees filtered protected tools. Set mcp_require_auth to 1 so every anonymous request gets a 401 and OAuth login is triggered.

Does the ai_platform MCP server support OAuth 2.1 with PKCE?▼

Yes, OAuth 2.1 is fully implemented with authorization code flow, PKCE restricted to S256, refresh token rotation that revokes both linked tokens, and RFC 7591 dynamic client registration supporting both none and client_secret_post authentication methods.

How do I test Claude Desktop against a local REDAXO MCP server?▼

Claude Desktop connectors run through Anthropic's cloud servers, so a localhost domain is unreachable. Use ngrok with an HTTPS upstream and a public URL, or use a local client like mcp-remote or Claude Code CLI with HTTP transport.

Why does my OAuth redirect fail with 'state: Field required'?▼

The PHP setting arg_separator.output may be set to &, causing http_build_query to produce code=X&state=Y where the parameter becomes amp;state. Always call http_build_query with an explicit ampersand separator when building redirect URLs.

When do scope changes take effect for an authenticated MCP user?▼

Scopes are snapshotted into the token at authorization time from the user's YCom groups. Changes to groups or scope mappings only apply after a new authorization, since refreshing a token does not expand its scopes.

Related Skills

Explore More Software Engineering Skills→
celigoceligo
3

building-mcp-servers

Configures Celigo Tool and builder-mode APIs as MCP server endpoints for external AI agents.

Official
Intermediate
EveryIncEveryInc
28

Editing

Refine marketing copy using editorial filters and structural surgery.

Official
Advanced
scalekit-incscalekit-inc

adding-oauth2-to-apis

Issue and validate OAuth 2.0 access tokens via Scalekit for Python and Node APIs.

Official
Advanced
pmcdowallpmcdowall

native-mcp

Connect AI agents to external MCP servers and expose their tools.

Community
Advanced