{"schemaVersion":1,"name":"Spala Project MCP Handoff Test Template","status":"template_no_results","boundary":"This is a public-safe test template, not proof of a completed OAuth handoff. It contains no tokens, private project IDs, private project URLs, customer data, source code, internal IPs, or private architecture.","canonicalPublicMcp":"https://mcp.spala.ai/mcp","agentRule":"Use the exact project mcpUrl returned by project_select or project_get_mcp_manifest after Spala platform authorization. Do not infer, append, or hardcode project MCP URLs.","auth":{"protectedResourceMetadata":"https://mcp.spala.ai/.well-known/oauth-protected-resource","authorizationServerMetadata":"https://mcp.spala.ai/.well-known/oauth-authorization-server","authorizationServer":"https://api.spala.ai/mcp","expectedAuthorizationHeader":"Authorization: Bearer <Spala platform access token>","authFailureBehavior":"Project tools return HTTP 401 with WWW-Authenticate and OAuth metadata when called without valid authorization."},"requiredFlow":[{"step":1,"call":"POST https://mcp.spala.ai/mcp initialize","expected":"Public MCP initializes with streamable HTTP.","redact":["client session IDs","debug headers"]},{"step":2,"call":"tools/list","expected":"Public discovery tools and auth-gated project handoff tools are visible. Auth-gated tools are marked requiresAuth in tool metadata.","redact":["client trace IDs"]},{"step":3,"call":"project_list without Authorization","expected":"HTTP 401 with WWW-Authenticate and OAuth metadata.","redact":["none expected"]},{"step":4,"call":"Complete Spala platform OAuth outside transcript","expected":"Client obtains a platform access token.","redact":["authorization codes","access tokens","refresh tokens","cookies","emails","account IDs"]},{"step":5,"call":"project_list with Authorization","expected":"Returns projects available to the authenticated user.","redact":["project IDs","project names unless demo-approved","organization IDs","owner emails"]},{"step":6,"call":"project_select","expected":"Returns the exact selected project mcpUrl.","redact":["private project IDs","private slugs","tenant identifiers","URL tokens"]},{"step":7,"call":"project_get_mcp_manifest","expected":"Returns project MCP manifest shape with exact mcpUrl and transport.","redact":["private project URL if it contains private identifiers"]}],"toolCapabilities":[{"name":"spala_help","requiresAuth":false,"effect":"read","purpose":"Explain Spala and public MCP starting points."},{"name":"spala_get_onboarding","requiresAuth":false,"effect":"read","purpose":"Return first-call onboarding for agents."},{"name":"spala_get_tool_map","requiresAuth":false,"effect":"read","purpose":"Return machine-readable public MCP vs project MCP routing."},{"name":"docs_search","requiresAuth":false,"effect":"read","purpose":"Search public Spala agent-facing docs index."},{"name":"template_list","requiresAuth":false,"effect":"read","purpose":"List public Spala backend templates for planning."},{"name":"addon_list","requiresAuth":false,"effect":"read","purpose":"List public Spala addons/integrations for planning."},{"name":"project_list","requiresAuth":true,"effect":"read","authFailureHint":"Follow HTTP 401 WWW-Authenticate resource metadata, complete Spala platform OAuth, then retry with Authorization: Bearer <token>.","purpose":"List projects available to the authenticated Spala platform user."},{"name":"project_create","requiresAuth":true,"dryRunOnly":true,"implemented":true,"effect":"no-op","authFailureHint":"Follow HTTP 401 WWW-Authenticate resource metadata, complete Spala platform OAuth, then retry with Authorization: Bearer <token>.","purpose":"Dry-run planning preview only in this deployment. Does not create a real project."},{"name":"project_select","requiresAuth":true,"effect":"read","authFailureHint":"Follow HTTP 401 WWW-Authenticate resource metadata, complete Spala platform OAuth, then retry with Authorization: Bearer <token>.","purpose":"Select a project and return the exact project mcpUrl. Do not infer this URL."},{"name":"project_get_mcp_manifest","requiresAuth":true,"effect":"read","authFailureHint":"Follow HTTP 401 WWW-Authenticate resource metadata, complete Spala platform OAuth, then retry with Authorization: Bearer <token>.","purpose":"Return the selected project MCP install manifest shape and exact mcpUrl."},{"name":"project_get_public_context","requiresAuth":true,"effect":"read","authFailureHint":"Follow HTTP 401 WWW-Authenticate resource metadata, complete Spala platform OAuth, then retry with Authorization: Bearer <token>.","purpose":"Return safe project handoff context for the selected authenticated project."}],"projectCreate":{"implemented":true,"dryRunOnly":true,"effect":"no-op","note":"project_create is dry-run only in this public MCP deployment and does not create a real project."},"claimsToAvoid":["Do not claim this template is proof of a completed authenticated handoff.","Do not claim public MCP anonymously creates, mutates, validates, or publishes projects.","Do not publish tokens, private project URLs, customer data, source code, internal IPs, or private architecture."]}