MCP (Portfolio: Cyberpunk)

OAuth-Protected Portfolio Access for AI Agents

CONNECTION GUIDE • DISCOVERY ENDPOINT

Overview

• Role: Full-Stack Engineering, OAuth and MCP implementation
• Stack: Next.js, TypeScript, Model Context Protocol, Streamable HTTP, OAuth 2.1, PKCE S256, Upstash Redis
• Key Result: A live, read-only MCP server that lets AI agents retrieve verified portfolio data through a standards-based OAuth flow.

The Problem

Portfolio information is useful to AI agents, but a public website alone does not provide a consistent, authenticated tool interface. The server needed to expose verified data without exposing private configuration, issuing long-lived secrets, or allowing write access.

Approach & Decisions

• Discovery first: The server publishes MCP, protected-resource, and OAuth authorization metadata under /.well-known so compatible clients can configure themselves.
• Standards-based access: Public clients register anonymously, then use OAuth authorization code flow with PKCE S256 and the portfolio.read scope.
• Read-only tools: The API exposes project listings and details, skills, experience, certificates, public profile information, and social links.
• Replay protection: OAuth authorization-code redemption uses Redis-backed one-time protection in production.

Available Tools

Verification

The production endpoint was tested externally through metadata discovery, public-client registration, authorization approval, PKCE token exchange, MCP initialization, tool discovery, and every read-only tool call.

Connect

Connect an MCP-compatible AI agent to the discovery endpoint. For manual OAuth integration, follow the connection guide.