Connect

8 clients · secrets stay placeholders

JSON (mcpServers)Claude CodeCodexOpenCodeCursorVS CodeGemini CLIGoose

{
  "mcpServers": {
    "tollbooth-oauth2-collector": {
      "type": "http",
      "url": "https://tollbooth-oauth2-collector.fastmcp.app/mcp"
    }
  }
}

claude mcp add --transport http tollbooth-oauth2-collector https://tollbooth-oauth2-collector.fastmcp.app/mcp

[mcp_servers.tollbooth-oauth2-collector]
url = "https://tollbooth-oauth2-collector.fastmcp.app/mcp"

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "tollbooth-oauth2-collector": {
      "type": "remote",
      "url": "https://tollbooth-oauth2-collector.fastmcp.app/mcp",
      "enabled": true
    }
  }
}

{
  "mcpServers": {
    "tollbooth-oauth2-collector": {
      "type": "http",
      "url": "https://tollbooth-oauth2-collector.fastmcp.app/mcp"
    }
  },
  "deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=tollbooth-oauth2-collector&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vdG9sbGJvb3RoLW9hdXRoMi1jb2xsZWN0b3IuZmFzdG1jcC5hcHAvbWNwIn0%3D"
}

{
  "servers": {
    "tollbooth-oauth2-collector": {
      "type": "http",
      "url": "https://tollbooth-oauth2-collector.fastmcp.app/mcp"
    }
  }
}

{
  "mcpServers": {
    "tollbooth-oauth2-collector": {
      "httpUrl": "https://tollbooth-oauth2-collector.fastmcp.app/mcp"
    }
  }
}

extensions:
  "tollbooth-oauth2-collector":
    enabled: true
    name: "tollbooth-oauth2-collector"
    type: streamable_http
    uri: "https://tollbooth-oauth2-collector.fastmcp.app/mcp"
    timeout: 300

Quality 83 / 100good

protocol88 · weight 25

pass
protocol.modernsupports 2026-07-28 (server/discover)
pass
protocol.statelessanswers without a session
pass
protocol.transportstreamable HTTP
warn
protocol.list_ttltools/list declares ttlMs 0, so clients re-fetch it on every use

authorizationn/a · weight 15

n/a
auth.prm, auth.as_metadata, auth.cimdno remote uses OAuth
n/a
auth.secret_in_urlno templated URL

tool hygiene71 · weight 30

pass
tools.descriptionsevery tool has a description
pass
tools.description_lengthdescriptions are concise
pass
tools.schemasevery tool has an object input schema
fail
tools.annotationsno tool declares readOnlyHint or destructiveHint, so clients cannot tell safe calls from risky ones
fail
tools.directory_hintsno tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: store_code (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); collector_status (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); retrieve_code (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); …
pass
tools.token_costabout 546 tokens to load every tool
pass
tools.api_dumptools are not a one-to-one API dump

stability100 · weight 15

pass
stability.changes4 tool changes in 30 days
pass
stability.rug_pullno tool changed its meaning under the same name

dependenciesn/a · weight 15

n/a
deps.known_vulns, deps.mcp_sdk_version, deps.resolvableno npm or PyPI package

4 tools, about 546 tokens to load them all · tool set 065fd9f0c967 · tools last changed 2026-10-18 · checked 2026-10-19 10:52 UTC

Tool changes

2026-10-18service_statuschangedtitle
2026-10-18collector_statuschangedtitle
2026-10-18retrieve_codechangedtitle
2026-10-18store_codechangedtitle

Full history: list_changes · trend: quality JSON.

Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.

Trust 91 / 100

provenance80

liveness100

freshness85

hygiene100

+repository +namespace-matches-repo +reachable +uptime-100% ~updated-56d-ago

Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.

Endpoints

remote	auth	reachable	uptime 30d	p50	protocol	last ok
`https://tollbooth-oauth2-collector.fastmcp.app/mcp` streamable-http	none	yes	100%	415 ms	2026-07-28	2026-10-19

Tools (4)

`collector_status`	Health check — shows the number of pending authorization codes and TTL.
`retrieve_code`	Retrieve a stored authorization code (one-time read, auto-deleted). Called by the originating MCP server to pick up the code after the user has authorized in the browser. Returns the encrypted code which the caller decrypts using the same state token.
`service_status`	Report the running build so a redeploy can be verified. Free. Delegates to the SDK's canonical ``build_service_status`` — the single source of the service_status payload shape — so this collector reports the same envelope as every other DPYC service. The load-bearing field is ``build_info.fastmcp_cloud_git_commit_sha``: the commit Horizon actually deployed. The post-merge deploy-verify probe reads it to confirm the live service redeployed the merged sha; with no ``service_status`` tool to probe, that sha reads as ``<none>`` and an otherwise-healthy deploy is flagged as "did not land". The vault/courier/operator fields are ``False``/empty by construction — this is an unauthenticated community utility with no operator runtime.
`store_code`	Store a sealed OAuth2 authorization code. Called by the serverless callback function after the browser redirect. The ``state`` carries BOTH the patron npub (the lookup/retrieve key) and the operator npub (the PUBLIC key the code is sealed to) — see the SDK's ``pack_oauth_state``. The code is sealed with NIP-44 to the operator so only that operator's nsec can open it; the Neon row is keyed by the patron npub, so retrieval (``retrieve_code(state=patron_npub)``) is unchanged.

Schemas: list_tools.

Similar MCP servers

More from io.github.lonniev

And 9 more from this publisher.

Official server.json

{
  "name": "io.github.lonniev/tollbooth-oauth2-collector",
  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
  "remotes": [
    {
      "url": "https://tollbooth-oauth2-collector.fastmcp.app/mcp",
      "type": "streamable-http"
    }
  ],
  "version": "0.2.11",
  "repository": {
    "url": "https://github.com/lonniev/tollbooth-oauth2-collector",
    "source": "github"
  },
  "description": "Unauthenticated OAuth2 callback collector for Tollbooth MCP services"
}