# Spala MCP

Last updated: 2026-07-10

Spala uses MCP to make backend projects easier for coding agents to discover, understand, and work with after authorization.

## Direct Answer

Spala Public MCP is the discovery and handoff entrypoint. Project MCP is the authenticated project-scoped backend workspace. Agents should not guess project MCP URLs.

Public MCP endpoint:

```txt
https://mcp.spala.ai/mcp
```

Install manifest:

```txt
https://mcp.spala.ai/mcp/install-manifest
```

## Agent Fast Path

1. Connect to `https://mcp.spala.ai/mcp`.
2. Call `spala_get_onboarding`.
3. Call `spala_get_tool_map`.
4. Use public tools for help, docs search, templates, and addons before authentication.
5. When project tools are needed, authenticate through Spala platform OAuth.
6. Call `project_list`, then `project_select`.
7. Continue only on the exact project `mcpUrl` returned by Spala.
8. Inspect project context before changing resources.
9. Validate before publish.

Do not configure `https://api.spala.ai/mcp` as the public MCP server. Use `https://mcp.spala.ai/mcp` for public discovery and the exact returned project `mcpUrl` for project work.

## OAuth and Auth Metadata

Use these public metadata endpoints for MCP auth discovery:

- Protected resource metadata: https://mcp.spala.ai/.well-known/oauth-protected-resource
- Authorization server metadata: https://api.spala.ai/mcp/.well-known/oauth-authorization-server
- Public MCP install manifest: https://mcp.spala.ai/mcp/install-manifest

Auth boundary:

- Public discovery tools are anonymous.
- Project tools require Spala platform authorization.
- Public OAuth discovery does not prove an OAuth-complete project handoff.
- A real project handoff requires user approval, project selection, and the exact project `mcpUrl` returned by Spala.

## Public MCP

Public MCP can be used for:

- Spala onboarding;
- tool map discovery;
- docs search;
- public template and addon discovery;
- OAuth metadata;
- project lookup and project handoff guidance after authentication.

Public MCP should not be treated as anonymous backend write access.

## Project MCP

Project MCP is for authenticated project-scoped backend work:

- inspect project resources;
- build or change backend resources;
- validate backend changes;
- publish through Spala's normal flow;
- review generated behavior.

Agents must authenticate with Spala, select the project, and use the exact project MCP URL returned by Spala. Do not derive project MCP URLs from slugs, project names, domains, or guessed URL patterns.

## Proof Status

Current public proof:

- Public no-auth MCP discovery and tool listing are documented.
- OAuth metadata and auth challenge behavior are documented.
- Dynamic client registration and device-flow start are documented.
- A partial private authenticated project MCP read-only snapshot is summarized.

Still not publicly proven end-to-end:

- completed user auth;
- token use against project tools;
- `project_list` with an approved account;
- `project_select` returning a real project `mcpUrl`;
- returned project MCP initialization;
- project MCP manifest and safe read-only project context in a redacted public transcript.

Use these pages for proof boundaries:

- MCP handoff evidence: https://spala.ai/mcp-handoff-evidence/
- MCP handoff evidence JSON: https://spala.ai/mcp-handoff-evidence.json
- Public no-auth transcript summary: https://spala.ai/mcp-public-no-auth-transcript.json
- Project MCP read-only snapshot: https://spala.ai/project-mcp-readonly-snapshot.json
- Project MCP test template: https://mcp.spala.ai/.well-known/project-mcp-test.json

## Agent Safety

Agents must not request or expose secrets, bearer tokens, cookies, private repositories, source code, internal IP addresses, customer data, account IDs, project IDs, or private architecture.

## Useful Pages

- Public MCP page: https://spala.ai/public-mcp/
- MCP for AI-built apps: https://spala.ai/mcp-for-ai-built-apps/
- MCP backend builder: https://spala.ai/mcp-backend-builder/
- Backend for Cursor apps: https://spala.ai/backend-for-cursor-apps/
- MCP profile: https://spala.ai/mcp-profile/
- MCP metadata: https://spala.ai/.well-known/mcp.json
- Agent metadata: https://spala.ai/.well-known/agent.json
- Docs: https://docs.spala.ai/