{"specs":[{"kind":"oauth-metadata","title":"Miro MCP authorization server","coverage":"hand-authored","operations":[{"operationId":"miro.oauth.authorizationServerMetadata","method":"GET","path":"/.well-known/oauth-authorization-server","status":"hand-authored"},{"operationId":"miro.oidc.configuration","method":"GET","path":"/.well-known/openid-configuration","status":"hand-authored"},{"operationId":"miro.oauth.register","method":"POST","path":"/register","status":"hand-authored"},{"operationId":"miro.oauth.authorize","method":"GET","path":"/authorize","status":"hand-authored"},{"operationId":"miro.oauth.approve","method":"POST","path":"/authorize","status":"hand-authored"},{"operationId":"miro.oauth.token","method":"POST","path":"/token","status":"hand-authored"},{"operationId":"miro.oauth.revoke","method":"POST","path":"/oidc/revoke","status":"hand-authored"},{"operationId":"miro.oauth.jwtBearer","status":"unsupported","summary":"jwt-bearer grant"},{"operationId":"miro.oauth.teamSelection","status":"unsupported","summary":"Team selection during consent"}]},{"kind":"mcp","title":"Miro MCP tool subset","coverage":"partial","operations":[{"operationId":"miro.mcp.protectedResourceMetadata","method":"GET","path":"/.well-known/oauth-protected-resource","status":"hand-authored"},{"operationId":"board_search_boards","status":"hand-authored"},{"operationId":"canvas_search","status":"hand-authored"},{"operationId":"canvas_read_as_svg","status":"unsupported","summary":"SVG canvas, comment, image, prototype, table, and write tools are not emulated."}]}],"surfaces":[{"id":"oauth","kind":"oauth","title":"Miro MCP OAuth and OIDC","status":"partial","basePath":"/","notes":"authorization_code and refresh_token grants. The jwt-bearer grant is advertised, as on the real server, but answers unsupported_grant_type. ID tokens are HS256 signed with the client secret, carry iss/sub/aud/exp/iat/email/email_verified, and omit nonce even when the authorization request sent one (seed id_token_nonce: echo to change that)."},{"id":"mcp","kind":"mcp","title":"Miro MCP server","status":"partial","basePath":"/","notes":"Streamable HTTP JSON-RPC at the origin root. Every request without a valid bearer token, on any unknown path, answers 401 with the resource_metadata challenge like Miro's gateway."},{"id":"consent","kind":"ui","title":"OAuth consent page","status":"supported","basePath":"/authorize"}]}