# Spala Project MCP Handoff Test Template

Status: template_no_results

This is a public-safe test template, not proof of a completed OAuth handoff. It contains no tokens, private project IDs, private project URLs, customer data, source code, internal IPs, or private architecture.

Agent rule: Use the exact project mcpUrl returned by project_select or project_get_mcp_manifest after Spala platform authorization. Do not infer, append, or hardcode project MCP URLs.

## OAuth

- Protected resource metadata: https://mcp.spala.ai/.well-known/oauth-protected-resource
- Authorization server metadata: https://mcp.spala.ai/.well-known/oauth-authorization-server
- Authorization server: https://api.spala.ai/mcp
- Expected header: Authorization: Bearer <Spala platform access token>
- Auth failure behavior: Project tools return HTTP 401 with WWW-Authenticate and OAuth metadata when called without valid authorization.

## Required flow

1. POST https://mcp.spala.ai/mcp initialize
   Expected: Public MCP initializes with streamable HTTP.
   Redact: client session IDs, debug headers

2. tools/list
   Expected: Public discovery tools and auth-gated project handoff tools are visible. Auth-gated tools are marked requiresAuth in tool metadata.
   Redact: client trace IDs

3. project_list without Authorization
   Expected: HTTP 401 with WWW-Authenticate and OAuth metadata.
   Redact: none expected

4. Complete Spala platform OAuth outside transcript
   Expected: Client obtains a platform access token.
   Redact: authorization codes, access tokens, refresh tokens, cookies, emails, account IDs

5. project_list with Authorization
   Expected: Returns projects available to the authenticated user.
   Redact: project IDs, project names unless demo-approved, organization IDs, owner emails

6. project_select
   Expected: Returns the exact selected project mcpUrl.
   Redact: private project IDs, private slugs, tenant identifiers, URL tokens

7. project_get_mcp_manifest
   Expected: Returns project MCP manifest shape with exact mcpUrl and transport.
   Redact: private project URL if it contains private identifiers

## project_create

- Implemented: true
- Dry-run only: true
- Effect: no-op
- Note: project_create is dry-run only in this public MCP deployment and does not create a real project.

Machine-readable JSON: https://mcp.spala.ai/.well-known/project-mcp-test.json