{
  "schema_version": "2026-07-09",
  "name": "Spala Public MCP No-Auth Transcript Summary",
  "status": "public_no_auth_capture",
  "purpose": "Public-safe transcript summary for Spala Public MCP discovery, tool listing, OAuth challenge, and OAuth metadata checks.",
  "boundary": "This proves only public/no-auth discovery and auth-challenge behavior. It is not proof of OAuth-complete project handoff, project_list with auth, project_select, returned project mcpUrl, project MCP manifest, or project context.",
  "generated_from": "local redacted capture reviewed for public-safe fields",
  "canonical_public_mcp": "https://mcp.spala.ai/mcp",
  "capture_steps": [
    {
      "order": 1,
      "name": "Connect to public MCP",
      "method": "initialize",
      "url": "https://mcp.spala.ai/mcp",
      "expected": "Public MCP initializes over streamable HTTP.",
      "observed_http_status": 200,
      "public_status": "captured_public"
    },
    {
      "order": 2,
      "name": "List public tools",
      "method": "tools/list",
      "url": "https://mcp.spala.ai/mcp",
      "expected": "Public discovery tools and auth-gated project tools are listed.",
      "observed_http_status": 200,
      "public_status": "captured_public"
    },
    {
      "order": 3,
      "name": "Trigger auth challenge",
      "method": "tools/call project_list without Authorization",
      "url": "https://mcp.spala.ai/mcp",
      "expected": "Auth-gated project tool returns HTTP 401 with OAuth challenge metadata.",
      "observed_http_status": 401,
      "public_status": "captured_public",
      "public_safe_excerpt": {
        "response_header_shape": {
          "www-authenticate": "Bearer resource_metadata=\"https://mcp.spala.ai/.well-known/oauth-protected-resource\"",
          "access-control-expose-headers": "WWW-Authenticate,Mcp-Session-Id"
        },
        "json_rpc_error_shape": {
          "code": -32001,
          "message": "Authentication required",
          "data": {
            "error": "authentication_required",
            "protectedResourceMetadata": "https://mcp.spala.ai/.well-known/oauth-protected-resource",
            "authorizationServerMetadata": "https://mcp.spala.ai/.well-known/oauth-authorization-server",
            "authorizationServer": "https://api.spala.ai/mcp",
            "expectedAuthorization": "Authorization: Bearer <Spala platform access token>"
          }
        },
        "redaction_note": "This excerpt intentionally omits request IDs, trace IDs, cookies, session IDs, tokens, emails, account IDs, and project identifiers."
      }
    },
    {
      "order": 4,
      "name": "Fetch OAuth protected resource metadata",
      "method": "GET",
      "url": "https://mcp.spala.ai/.well-known/oauth-protected-resource",
      "expected": "Protected-resource metadata is publicly discoverable.",
      "observed_http_status": 200,
      "public_status": "captured_public"
    },
    {
      "order": 5,
      "name": "Fetch OAuth authorization server metadata",
      "method": "GET",
      "url": "https://mcp.spala.ai/.well-known/oauth-authorization-server",
      "expected": "Authorization-server metadata is publicly discoverable.",
      "observed_http_status": 200,
      "public_status": "captured_public"
    },
    {
      "order": 6,
      "name": "Authorized project handoff",
      "method": "project_list/project_select/project_get_mcp_manifest with Authorization",
      "url": "https://mcp.spala.ai/mcp",
      "expected": "Requires approved demo account and bearer token.",
      "observed_http_status": null,
      "public_status": "not_captured_missing_token"
    }
  ],
  "claims_to_avoid": [
    "Do not claim this is an OAuth-complete handoff transcript.",
    "Do not claim public MCP anonymously returns private projects or creates projects.",
    "Do not claim project MCP URLs are guessable or pattern-derived.",
    "Do not claim production readiness, compliance, SLA, backups, export, or customer proof from this transcript."
  ],
  "next_proof_needed": "Run an approved demo-account capture with authorization, redact all private fields, and publish only a reviewed OAuth-complete transcript showing project_list, project_select, exact returned mcpUrl, project_get_mcp_manifest, and read-only project context."
}