The only transport is Streamable HTTP. POST JSON-RPC to https://ogpilot.com/mcp. GET does not open an SSE stream. There is no stdio binary, no local command, and no API-key header. A client that can only launch a process cannot connect.
Auth is OAuth 2.1 with PKCE (S256). The client discovers /.well-known/oauth-protected-resource and /.well-known/oauth-authorization-server, registers at /oauth/register if it does not already have a client id, then opens /oauth/authorize. Leave the OAuth client id and secret blank unless the client asks you to paste values from a failed registration. Supported scopes are mcp:generate and offline_access. All four tools use mcp:generate.
On the consent page, choose Allow. A guest connector session can debug, compress, and extract a palette. To generate an image, use the account link on that page and approve while signed in to an account with an active plan. Access tokens last 1 hour. The token response also includes a refresh token that lasts 90 days. Authorization codes last 10 minutes.
This block is the remote entry the repo ships. Claude and ChatGPT do not read this file. They use the steps under it. Do not add command, args, or a bearer token.
On Team and Enterprise, an owner adds the custom connector under Organization settings, then Connectors. Members then connect from Customize, then Connectors.
Developer mode is for testing a custom MCP server. The settings label moves. Look under Security, Advanced, or workspace permissions. tools/list does not push changes (listChanged is false). Reconnect after a tool update.