{"data":{"name":"Approve MCP","endpoint":"/mcp","status":"ok","connection":{"endpoint":"https://mcp.approve.so/mcp","transport":"streamable-http","authentication":"OAuth 2.1 with PKCE; initiated by the MCP client","resource_metadata":"https://mcp.approve.so/.well-known/oauth-protected-resource/mcp","authorization_server_metadata":"https://mcp.approve.so/.well-known/oauth-authorization-server","documentation_url":"https://approve.so/docs/mcp","instructions_url":"https://mcp.approve.so/llms.txt","codex":{"add":"codex mcp add approve --url https://mcp.approve.so/mcp","login":"codex mcp login approve","read_only_login":"codex mcp login approve --scopes approve:read"},"steps":["When a user asks you to use Approve, reuse an authenticated MCP connection if one is available.","If the server is not configured, add the endpoint below as a remote Streamable HTTP MCP server in your client.","On HTTP 401, let your client refresh its saved session. If login is still required, start the client's OAuth login flow and open the authorization URL it generates. A 401 means authentication is required; it is not evidence that the service is broken.","Keep the login process running while the user signs in on approve.so, selects workspaces and permissions, and confirms with their Approve password. If you cannot open a browser, show the generated URL to the user. Never ask them to paste passwords or tokens into chat.","Wait for the client to confirm login, then call approve_workspace_list and resume the user's original task. A consent-page click or a healthy server alone does not verify access.","If the request expired, was already used, or the callback listener stopped, start one fresh client login. Do not reuse old consent URLs or repeatedly restart a login that is still waiting for the user.","For HTTP 403 or a missing tool, check the selected workspaces, granted scopes, and the user's permissions. Reconnect only if a different selection is needed; repeated login does not grant missing account permissions."]}}}