MCP OAuth and PKCE
Approve a remote MCP client's access and revoke it when no longer needed.
On this page
What you need
A compatible MCP client and an account you can sign in to.
How to do it
- Connect the client to https://metribeacon.com/mcp and open its authorisation page.
- Check the client name and requested permissions. Start with reading; select configuration, key or telemetry changes only if needed.
- Confirm and return to the client. To stop access later, revoke the connection in Settings or with mcp connections revoke ID --yes.
Good to know
The client handles OAuth and PKCE, a check binding the sign-in to that client. You normally do not need to construct token requests yourself. Access tokens last 15 minutes; supported clients refresh them automatically.
For client developers: use /.well-known/oauth-protected-resource/mcp and /.well-known/oauth-authorization-server, S256 PKCE and the exact resource https://metribeacon.com/mcp. The API reference describes registration, authorisation and token requests.
A connection ends after 30 days or seven days without use. Refresh does not add permissions; a broader grant needs a new approval. A public client name alone is not proof of its identity.
If something goes wrong
Restart the connection if approval expired or opened in a different browser. Client developers should check the exact redirect URI, resource and PKCE verifier without logging codes or tokens.
Related guides
- Local and remote MCP access
Connect a compatible AI client to your monitoring with limited access.
- Complete MCP tool catalog
Find monitoring tools and check their inputs before asking a client to make changes.