MCP verification
Verify what the public MCP does.
Test the real public endpoint: discovery tools work anonymously, then browser OAuth enables the verified project handoff.
Purpose of this test
This is a reproducible check of public discovery and the verified project handoff.
Install the public MCP, call spala_start as the protected first call after restart or resume, follow exactly its one nextAction and repeat it only when that action explicitly requests it, complete browser-only OAuth or payment when required, follow the terminal account/company/project prompts, and verify the exact project MCP before any application planning or coding. Never echo the bootstrap consume URL or any token.
Smoke-test sequence
- Configure
https://mcp.spala.ai/mcpwith the latest-channel package-runner command and follow its restart or resume output. - After the required restart or resume, call spala_start as the protected first call. Follow exactly its one nextAction and call spala_start again only when that action explicitly requests it after a state transition. OAuth and any optional payment happen only in the browser; never start a parallel login, manually reopen an authorization URL, or request credentials or payment details in the terminal.
- Ask in the terminal only for missing account, company, and project details. Create the first organization from confirmed company details when none exists. When multiple organizations or projects are available, present the choices and wait for selection. Automatically reuse a valid local .spala/project.json binding; otherwise select the intended project or create the confirmed project. Connect, bind, and verify the selected project MCP before application work.
- Call
project_connectonce. Start installPlan.argv[0] with installPlan.argv.slice(1) as a direct process using tty:true and shell:false. After the process is running, write bootstrap.consumeUrl plus a newline to process stdin. Never put the consume URL in shell text, argv, logs, or files. - Restart or resume as instructed, then bind and verify the exact intended project MCP. Do not inspect application files, plan the application, or write code until the exact intended project MCP is loaded and verified.
- This agent flow does not replace normal dashboard onboarding, project creation, or project browsing.
Expected outcomes
| Check | Expected result |
|---|---|
| Transport | Streamable HTTP at https://mcp.spala.ai/mcp. |
| Public tools | Discovery, docs search, template list, and addon list are usable without authentication. |
| Browser authentication | The user signs in or creates an account only when needed; agentic authorization completes server-side. |
| Project handoff | project_connect returns an exact workspace-only install plan and one-time bootstrap consume URL. |
| Project binding | Binding is local to the workspace, not global; no token or URL is exposed. |