{"specs":[{"kind":"oauth-metadata","title":"PlanetScale OAuth authorization server","coverage":"hand-authored","operations":[{"operationId":"planetscale.oauth.authorizationServerMetadata","method":"GET","path":"/.well-known/oauth-authorization-server","status":"hand-authored"},{"operationId":"planetscale.oauth.register","method":"POST","path":"/oauth/registration","status":"hand-authored"},{"operationId":"planetscale.oauth.authorize","method":"GET","path":"/oauth/authorize","status":"hand-authored"},{"operationId":"planetscale.oauth.approve","method":"POST","path":"/oauth/authorize","status":"hand-authored"},{"operationId":"planetscale.oauth.token","method":"POST","path":"/oauth/token","status":"hand-authored"},{"operationId":"planetscale.oauth.revoke","method":"POST","path":"/oauth/revoke","status":"hand-authored"},{"operationId":"planetscale.oauth.deviceCode","status":"unsupported","summary":"device_code grant"},{"operationId":"planetscale.oauth.clientCredentials","status":"unsupported","summary":"client_credentials grant"},{"operationId":"planetscale.oauth.userinfo","status":"unsupported","summary":"OIDC userinfo and id tokens"}]},{"kind":"mcp","title":"PlanetScale MCP tool subset","coverage":"partial","operations":[{"operationId":"planetscale.mcp.protectedResourceMetadata","method":"GET","path":"/.well-known/oauth-protected-resource/mcp/planetscale","status":"hand-authored"},{"operationId":"planetscale_list_organizations","status":"hand-authored"},{"operationId":"planetscale_get_organization","status":"hand-authored"},{"operationId":"planetscale_list_databases","status":"hand-authored"},{"operationId":"planetscale_get_database","status":"hand-authored"},{"operationId":"planetscale_list_branches","status":"hand-authored"},{"operationId":"planetscale_execute_read_query","status":"unsupported","summary":"Query, schema, insights, and billing tools are not emulated."}]}],"surfaces":[{"id":"oauth","kind":"oauth","title":"PlanetScale OAuth (Doorkeeper)","status":"partial","basePath":"/oauth","notes":"authorization_code and refresh_token grants only. Client authentication compares the HTTP Basic credentials literally after base64 decoding, with no form url decoding, exactly like Doorkeeper. A percent encoded client_id or client_secret fails with 401 invalid_client."},{"id":"mcp","kind":"mcp","title":"PlanetScale MCP server","status":"partial","basePath":"/mcp/planetscale","notes":"Streamable HTTP. OAuth access tokens only; MCP service tokens are not emulated."},{"id":"consent","kind":"ui","title":"OAuth consent page","status":"supported","basePath":"/oauth/authorize"}]}