> ## Documentation Index
> Fetch the complete documentation index at: https://docs.quote.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# MCP and OAuth

> Four tools, Streamable HTTP, scoped credentials

Connect at `https://mcp.quote.dev/mcp` using Streamable HTTP and `Authorization: Bearer <token>`. API keys (`qd_test_`, `qd_live_`) remain supported alongside opaque OAuth access tokens. Credentials are request-scoped; the gateway checks private-tool credentials through `GET /v1/auth/oauth-session`, then the API enforces operation scopes. Inactive tokens receive a 401 challenge; unavailable validation fails closed.

Exactly four tools are exposed:

| Tool | API operation |
| - | - |
| `quote_discover_packs` | Public `GET /v1/packs` |
| `quote_estimate` | `POST /v1/estimates` |
| `quote_hold_deposit` | `POST /v1/quotes`, with `idempotency_key` |
| `quote_status` | `GET /v1/quotes/:id`; OAuth requires `quote_id` |

Registration is REST/CLI, not a fifth tool. Combined tool schema stays below 1,500 approximate tokens, enforced by hermetic Worker tests. Intake completeness is validated by the API: preserve structured 422 fields and suggested questions. Return escalation and continuation URLs verbatim, including on status reads; never fabricate success.

[OAuth discovery and PKCE](https://docs.quote.dev/auth.md) use the API issuer. The MCP Worker forwards authorization-server metadata and `/oauth/register`, `/oauth/authorize`, `/oauth/token` only through its API service binding, never a public-network fallback. Resource metadata identifies `https://mcp.quote.dev/mcp`. Host and browser Origin guards remain active. Private-tool 401 responses include resource discovery hints.

Local tests are hermetic. No live Claude/Cursor OAuth, deployments or external payment calls are required.

Only direct API keys may omit `quote_id` for legacy private agent claim status. That route can return a raw live key once and is never delegated through OAuth, regardless of scopes. `qd_poll_` tokens remain REST-only at `/v1/auth/agent-status`; MCP session validation rejects them, and they cannot authorize quote actions. The M2 MCP gateway also excluded poll tokens.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.