Atlasly MCP Authentication: Discovery, Permissions and Integration Limits

Configure the server URL in the client, then let its MCP connection flow initialize the session and request tools/list. Initialization negotiates a protocol version; tools/list supplies the available names and input schemas.

The read-only discovery URLs checked in this review were:

• Protected-resource metadata, identifying the protected resource and authorization server.
• Authorization-server metadata, describing authorization, token, registration and revocation endpoints.

Read these documents afresh when configuring an integration. Do not infer that a protocol revision in an article is the version negotiated by your client; the reviewed initialization response negotiated 2025-03-26.

The live metadata advertises authorization-code and refresh-token grants, public-client token authentication, S256 proof-key challenges, and client metadata document support. Its advertised scope names are atlasly.mcp, atlasly.projects.write, atlasly.site_package.run, atlasly.site_watch.write and offline_access. Scope availability does not establish that an account has a particular entitlement.

The current MCP authorization specification describes discovery, resource-bound access tokens and the OAuth authorization flow. Use a client implementation that validates state and issuer, uses S256 PKCE, and identifies the intended protected resource in the authorization and token requests. Request only the permissions needed. Do not place a token in a source file, public browser bundle, screenshot or shared log.

These are integration requirements to verify, not a certification that every Atlasly client or private authentication path has passed an end-to-end compliance test.

Public discovery returned 27 tool definitions without credentials. Availability in that list does not prove a data source will answer a particular site query or establish unlimited production usage. Observe current account terms and any returned service limits.

The source implementation also defines create_project_from_site, run_site_package, get_job_status, generate_site_brief and enable_site_watch behind account permissions. They were not present in the unauthenticated discovery response. Re-run discovery after authorization and use the schema actually returned for that session. Confirm the requested project action with its owner before saving a project, starting a package or enabling recurring checks.

Use the authentication challenge and client connection flow when credentials expire. Refresh only when the server issued an eligible refresh token; do not assume a fixed token lifetime or that every connection grants offline access. Store credentials in the client’s supported secure storage and use its disconnect or revocation flow when access is no longer needed.

A missing tool can reflect authentication or permission differences. A returned error can also mean invalid input, a service limit, unsupported geography or an unavailable source. Keep these cases distinct.

Do not blindly retry actions that create projects or start work after a timeout: the first request may already have succeeded. Check a returned project or job identifier before repeating a write. Respect retry guidance for read operations and retain the original error for diagnosis.

The previously published REST hostname api.atlasly.app did not resolve during the public check on 12 September 2026. Public MCP discovery was reachable separately. This guide therefore does not supply a replacement REST request, billing allowance, webhook payload or signature-verification recipe. A backend route found in source is not sufficient evidence of a published production API.

Consult developer documentation for the current publication status. Obtain a verified base URL, authentication contract, request schema, response examples and operation-specific retry rules before building a REST integration.

Keep enough diagnostic context to identify the operation and failure, while excluding access tokens and unnecessary project information. Atlasly’s MCP source contains operational logging of tool calls and site location information. This review does not establish a retention period, anonymity guarantee or contractual data-processing terms. Review current terms and the actual information your client sends before using sensitive project material.

For source interpretation and tool selection, continue with the MCP tools reference.