{
  "schema_version": "2026-07-10",
  "name": "Spala Public MCP Auth And Handoff Proof",
  "status": "public_auth_challenge_verified_authenticated_project_handoff_still_needs_redacted_account_transcript",
  "generated_at": "2026-07-10",
  "observed_from": "public unauthenticated HTTP/MCP calls",
  "claim_boundary": "This artifact proves public MCP discovery, OAuth metadata, unauthenticated auth challenge behavior, CORS preflight behavior, invalid JSON error format, and public docs search coverage. It does not prove a completed OAuth login, authenticated project_list/project_select output, real project creation, billing state, or project MCP mutation capability.",
  "endpoint": "https://mcp.spala.ai/mcp",
  "checks": [
    {
      "name": "root_landing_json",
      "method": "GET",
      "url": "https://mcp.spala.ai/",
      "status": 200,
      "result": "pass",
      "evidence": {
        "name": "Spala Public MCP",
        "canonicalMcpUrl": "https://mcp.spala.ai/mcp",
        "purpose": "Public agent front door for Spala discovery, platform auth, project lookup, and project MCP handoff.",
        "publicTools": [
          "spala_help",
          "spala_get_onboarding",
          "spala_get_tool_map",
          "docs_search",
          "template_list",
          "addon_list"
        ],
        "authenticatedTools": [
          "project_list",
          "project_create",
          "project_select",
          "project_get_mcp_manifest",
          "project_get_public_context"
        ],
        "projectCreateCapability": {
          "dryRunOnly": true,
          "effect": "no-op"
        }
      }
    },
    {
      "name": "oauth_protected_resource_metadata",
      "method": "GET",
      "url": "https://mcp.spala.ai/.well-known/oauth-protected-resource",
      "status": 200,
      "result": "pass",
      "evidence": {
        "resource": "https://mcp.spala.ai/mcp",
        "authorization_servers": [
          "https://api.spala.ai/mcp"
        ],
        "bearer_methods_supported": [
          "header"
        ],
        "note": "api.spala.ai/mcp is the Spala platform OAuth authorization server; mcp.spala.ai/mcp is the public MCP URL agents should configure."
      }
    },
    {
      "name": "oauth_authorization_server_metadata",
      "method": "GET",
      "url": "https://mcp.spala.ai/.well-known/oauth-authorization-server",
      "status": 200,
      "result": "pass",
      "evidence": {
        "issuer": "https://api.spala.ai/mcp",
        "authorization_endpoint": "https://api.spala.ai/mcp/oauth/authorize",
        "token_endpoint": "https://api.spala.ai/mcp/oauth/token",
        "registration_endpoint": "https://api.spala.ai/mcp/oauth/register",
        "device_authorization_endpoint": "https://api.spala.ai/mcp/oauth/device_authorization",
        "grant_types_supported": [
          "authorization_code",
          "urn:ietf:params:oauth:grant-type:device_code"
        ],
        "code_challenge_methods_supported": [
          "S256"
        ]
      }
    },
    {
      "name": "mcp_initialize",
      "method": "POST",
      "url": "https://mcp.spala.ai/mcp",
      "status": 200,
      "content_type": "text/event-stream",
      "result": "pass",
      "evidence": {
        "protocolVersion": "2025-06-18",
        "serverInfo": {
          "name": "Spala Public MCP",
          "version": "0.1.0"
        },
        "instructions_summary": "Use public MCP for discovery, docs/templates/addons, authentication-aware project discovery, and project MCP handoff. Use the exact returned project mcpUrl; do not construct project MCP URLs."
      }
    },
    {
      "name": "mcp_tools_list",
      "method": "POST",
      "url": "https://mcp.spala.ai/mcp",
      "status": 200,
      "content_type": "text/event-stream",
      "result": "pass",
      "evidence": {
        "tool_count": 11,
        "public_tools": [
          "spala_help",
          "spala_get_onboarding",
          "spala_get_tool_map",
          "docs_search",
          "template_list",
          "addon_list"
        ],
        "authenticated_tools": [
          "project_list",
          "project_create",
          "project_select",
          "project_get_mcp_manifest",
          "project_get_public_context"
        ]
      }
    },
    {
      "name": "docs_search_auth_handoff_query",
      "method": "POST tools/call docs_search",
      "url": "https://mcp.spala.ai/mcp",
      "status": 200,
      "result": "pass",
      "query": "auth oauth token project mcp handoff",
      "evidence": {
        "top_result_ids": [
          "public-mcp",
          "agent-setup-auth-handoff",
          "auth-oauth-platform",
          "mcp-smoke-test",
          "project-mcp-resolution"
        ],
        "note": "The central auth/project-handoff query now returns relevant results instead of an empty result set."
      }
    },
    {
      "name": "project_list_without_token",
      "method": "POST tools/call project_list",
      "url": "https://mcp.spala.ai/mcp",
      "status": 401,
      "result": "pass",
      "evidence": {
        "www_authenticate": "Bearer resource_metadata=\"https://mcp.spala.ai/.well-known/oauth-protected-resource\"",
        "jsonrpc_error_code": -32001,
        "jsonrpc_error_message": "Authentication required",
        "error_data": {
          "error": "authentication_required",
          "protectedResourceMetadata": "https://mcp.spala.ai/.well-known/oauth-protected-resource",
          "authorizationServerMetadata": "https://mcp.spala.ai/.well-known/oauth-authorization-server",
          "authorizationServer": "https://api.spala.ai/mcp",
          "authorizationEndpoint": "https://api.spala.ai/mcp/oauth/authorize",
          "tokenEndpoint": "https://api.spala.ai/mcp/oauth/token",
          "deviceAuthorizationEndpoint": "https://api.spala.ai/mcp/oauth/device_authorization",
          "registrationEndpoint": "https://api.spala.ai/mcp/oauth/register",
          "dashboardUrl": "https://dashboard.spala.ai",
          "expectedAuthorization": "Authorization: Bearer <Spala platform access token>"
        }
      }
    },
    {
      "name": "project_select_without_token",
      "method": "POST tools/call project_select",
      "url": "https://mcp.spala.ai/mcp",
      "status": 401,
      "result": "pass",
      "evidence": {
        "www_authenticate": "Bearer resource_metadata=\"https://mcp.spala.ai/.well-known/oauth-protected-resource\"",
        "jsonrpc_error_code": -32001,
        "jsonrpc_error_message": "Authentication required",
        "note": "Unauthenticated project_select now returns a transport-level auth challenge instead of a silent MCP isError-only response."
      }
    },
    {
      "name": "invalid_json_error",
      "method": "POST invalid JSON body",
      "url": "https://mcp.spala.ai/mcp",
      "status": 400,
      "result": "pass",
      "evidence": {
        "content_type": "application/json; charset=utf-8",
        "jsonrpc": "2.0",
        "id": null,
        "error": {
          "code": -32700,
          "message": "Parse error",
          "data": {
            "error": "invalid_json",
            "message": "Request body must be valid JSON-RPC JSON."
          }
        }
      }
    },
    {
      "name": "cors_preflight",
      "method": "OPTIONS",
      "url": "https://mcp.spala.ai/mcp",
      "status": 204,
      "result": "pass",
      "evidence": {
        "access-control-allow-methods": "GET,POST,OPTIONS",
        "access-control-allow-headers": "Authorization,Content-Type,Accept,Mcp-Session-Id,Last-Event-ID",
        "access-control-expose-headers": "WWW-Authenticate,Mcp-Session-Id"
      }
    }
  ],
  "still_pending": [
    "Redacted OAuth login transcript from a real test account.",
    "Authenticated project_list response showing available project shape.",
    "Authenticated project_select or project_get_mcp_manifest response showing the exact returned project mcpUrl.",
    "Authenticated project MCP initialization and read-only onboarding/tool-map proof.",
    "Real project creation remains dry-run only in the public MCP deployment unless intentionally changed."
  ],
  "related": {
    "mcp_profile": "https://spala.ai/mcp-profile/",
    "post_hardening_retest": "https://spala.ai/agent-evals/public-audit-batch-2026-07-10-post-hardening-retest.json",
    "visibility_foundation_report": "https://spala.ai/visibility-foundation-report-2026-07-10/",
    "server_card": "https://mcp.spala.ai/.well-known/mcp/server-card.json"
  }
}