Which transport does the Nodaro MCP server use?

Streamable HTTP, at https://mcp.nodaro.ai/mcp. Sign-in is OAuth 2.0 with PKCE, and a client can register itself with Dynamic Client Registration.

Why does registration fail with client_not_allowed?

Dynamic registration accepts only known client names, and your client's name is not on the list. Register a developer app in your Nodaro settings instead, and use its client id and secret.

How long does an access token from the Nodaro MCP server last?

90 days. There are no refresh tokens, so after 90 days the user signs in again. Tokens can be revoked earlier from the Nodaro settings.

Can I test the Nodaro MCP server with MCP Inspector?

Yes. MCP Inspector is one of the client names that can register dynamically, so it can connect, sign in and list the tools.

Connect your own MCP client to Nodaro — Streamable HTTP, OAuth discovery and registration

Connect any MCP client to Nodaro over Streamable HTTP, discover the OAuth server, register the client or a developer app, and sign in with PKCE.

Your own client can connect to Nodaro if it speaks standard MCP over Streamable HTTP and signs in with OAuth. Point it at https://mcp.nodaro.ai/mcp, let it discover the OAuth server, register it, and send the user through the consent screen. This page lists the endpoints, the registration rules and the token lifetime.

What your client needs

MCP over Streamable HTTP at https://mcp.nodaro.ai/mcp.
OAuth 2.0 authorization code flow with PKCE. Only the S256 code challenge method is accepted.
OAuth discovery through the protected resource metadata (RFC 9728) and the authorization server metadata (RFC 8414).
A client registration, either through Dynamic Client Registration (RFC 7591) or as a developer app you register once.

Endpoints

What	Where
MCP endpoint	`https://mcp.nodaro.ai/mcp`
Protected resource metadata	`https://mcp.nodaro.ai/.well-known/oauth-protected-resource`
Authorization server metadata	`https://app.nodaro.ai/.well-known/oauth-authorization-server`
Dynamic Client Registration	`POST https://app.nodaro.ai/v1/oauth/register`
Token exchange	`POST https://app.nodaro.ai/v1/oauth/token`
Token revocation	`POST https://app.nodaro.ai/v1/oauth/revoke`

Both metadata documents are served on both hosts, app.nodaro.ai and mcp.nodaro.ai. Each one is also served with a /mcp suffix, for example /.well-known/oauth-protected-resource/mcp, because some clients probe that form first. The authorization server metadata advertises the authorization, token, registration and revocation endpoints, the code response type, the authorization_code grant, S256 PKCE, client_secret_post authentication and the supported scopes.

The connection flow

Discover the authorization server

Read the protected resource metadata from the MCP host. It binds the resource https://mcp.nodaro.ai/mcp to its authorization server, https://app.nodaro.ai. Then read the authorization server metadata for the endpoints.

Register the client

Send your client_name and redirect URIs to the registration endpoint. Nodaro answers with a client_id that starts with ndr_dcr_ and a client_secret. The endpoint accepts 10 requests per minute from one IP address.

Open the authorization endpoint in the browser with your client_id, redirect_uri, response_type=code, the scope list, a random state, and the PKCE code_challenge with code_challenge_method=S256. The user signs in, reviews the permissions and clicks Allow.

Exchange the code

Nodaro redirects to your redirect_uri with a code and your state. Check the state, then exchange the code at the token endpoint with your code_verifier. A code works once and expires 10 minutes after it is issued.

Call the MCP endpoint

Send the access token, which starts with ndr_app_, as Authorization: Bearer <token> on every request to https://mcp.nodaro.ai/mcp. List the tools with tools/list.

Which client names can register

By default, Dynamic Client Registration accepts only known client names: Claude, Claude Code, Cursor, Cline, Continue, Goose, ChatGPT, OpenAI, Lovable, Gemini, Gemini CLI, Codex, MCP Inspector and mcp-inspector. A client with another name receives 403 client_not_allowed.

If your client has another name, register it once as a developer app instead:

Open app.nodaro.ai/settings/developer-apps and click New developer app.
Enter the name, the redirect URIs and the scopes the client may request.
Copy the client_id and the client_secret. The secret is shown only once. It does not expire, and you can rotate it on the app's page.

Each account can register up to 5 developer apps by hand. Clients that registered themselves appear in the same list but do not count toward that limit.

On your own Nodaro instance, the operator controls registration with MCP_DYNAMIC_REGISTRATION (allowlist, the default, open or off) and MCP_DCR_ALLOWLIST. In open mode, one client name and redirect URI pair can hold at most 5 unused registrations in 24 hours; more return 429 too_many_open_registrations. In off mode, registration returns 403 dcr_disabled. See MCP on a self-hosted install.

Tokens

Lifetime. An access token lasts 90 days. There are no refresh tokens: when a call returns 401, send the user through the consent screen again.
Revocation. Your client can revoke a token at the revocation endpoint, which always answers 200. The user can also revoke the app at app.nodaro.ai/settings/developer-apps.
The consent screen. Because a dynamically registered client chose its own name, the consent screen warns the user that Nodaro did not verify it.

The same OAuth server serves the REST API. OAuth for developers covers it in full.

Handle tool results

Jobs. Generation tools start a job and return its id at once. Poll get_job every 5 to 10 seconds, or call wait_for_job, until the job is completed or failed. See Job tools.
Structured content. Many tools return their data as structuredContent next to the text reply, for example the job envelope of get_job. Read the structured data in code.
Cards are optional. Hosts that display MCP Apps get interactive cards, such as job progress and upload pickers. A client without them reads the same results as text and structured data.
Tasks. A client that supports the MCP tasks API receives job progress through it.
Missing tools. A tool whose scope the user did not grant is left out of tools/list. Check the granted scopes before you look for a missing tool.

Common mistakes

Using https://app.nodaro.ai/mcp. That address is a web page. A POST to it returns 405 with the error code wrong_mcp_host, which names the correct URL.
Using https://api.nodaro.ai/mcp. That domain does not exist.
Adding a trailing slash. Use https://mcp.nodaro.ai/mcp exactly.

Your own client