iiRDS MCP Server

This endpoint advertises OAuth 2.1 discovery metadata. A spec-compliant MCP client — Claude Desktop, Claude Code, mcp-inspector — needs only this server's URL; it discovers the authorization server and requests a client on its own. For example, with Claude Code:

claude mcp add --transport http iirds https://mcp.iirds.syndeos.de

Authorization server

https://auth.syndeos.de/realms/request-api

Automatic client registration depends on the authorization server's own policy. If a client's registration attempt fails, this deployment needs a pre-registered client instead — see DEVELOPMENT.md for that walkthrough.

Every request needs an Authorization: Bearer <token> header. This server forwards it as-is to the iiRDS Request API, which is the sole authority on whether it's valid — nothing is checked here.

The most common token is a short-lived DID proof-JWT. A DID is just an Ed25519 keypair (did:jwk:…) — generating one is self-service, but this deployment's operator must authorize it before it can call this server: they issue a one-time registration token naming which archives you may see, which you redeem once against the Request API. From then on, each request is signed fresh with your own private key (a proof of ownership, not a credential the operator hands you every time).

The Request API also accepts its own regular API tokens as an alternative to DID proof-JWTs — see its info page for the full authentication model: http://iirds.iirds.svc.cluster.local:3500.

Have a keypair already but no registration token? Contact this deployment's operator — there is no self-serve registration for DIDs.