Get protected resource metadata

GET/.well-known/oauth-protected-resource

Describes the MCP server as an OAuth protected resource (RFC 9728): its address, the authorization server that issues its tokens, and the scopes it understands. An MCP client reads it after a 401 from Call the MCP server to find where to sign in.

Scope	Heavy call	Long poll	CLI
None, no key	No	No	None

Guidance

It lives at the root of https://api.chartnaut.com, not under /v1. The same document is also served at /.well-known/oauth-protected-resource/v1/mcp, the address the 401 challenge names.
Read authorization_servers[0], then fetch Get authorization server metadata from it.
resource is the value to send as resource in Start an authorization and Get a token. Tokens are issued for this one resource only.
It is public and cached for 5 minutes.

Response

200 with:

Field	Type	Description
`resource`	string	`https://api.chartnaut.com/v1/mcp`
`authorization_servers`	array of string	`https://api.chartnaut.com`
`scopes_supported`	array of string	`scripts:read`, `scripts:write`, `runs:write`
`bearer_methods_supported`	array of string	`header`: send the token in `Authorization`
`resource_name`	string	`Chartnaut`

Status codes

Status	Code	Meaning
`200`	-	The metadata

Example request

curl https://api.chartnaut.com/.well-known/oauth-protected-resource

Example response

200 OK

{
  "resource": "https://api.chartnaut.com/v1/mcp",
  "authorization_servers": ["https://api.chartnaut.com"],
  "scopes_supported": ["scripts:read", "scripts:write", "runs:write"],
  "bearer_methods_supported": ["header"],
  "resource_name": "Chartnaut"
}

From the CLI

There is no CLI command for this endpoint.