# EQUIRE connector authentication

EQUIRE's MCP connector is available only to authenticated users in approved EQUIRE organizations. It does not offer anonymous access, a test tenant, or a public sandbox.

## Discovery

- MCP resource: https://www.equire.ai/mcp
- Protected-resource metadata: https://www.equire.ai/.well-known/oauth-protected-resource/mcp
- Authorization-server metadata: https://www.equire.ai/.well-known/oauth-authorization-server
- Server card: https://www.equire.ai/.well-known/mcp/server-card.json

## OAuth flow

Use OAuth authorization code with PKCE S256 and a public client. Dynamic client registration is available at https://www.equire.ai/oauth/register for allowlisted redirect origins. The authorization endpoint is https://www.equire.ai/oauth/authorize and the token endpoint is https://www.equire.ai/oauth/token.

Clients may request authorization_code and refresh_token grants. Authorization codes are single use and are consumed only after client, redirect URI, resource, and PKCE validation. Refresh tokens rotate on every successful exchange.

## Scopes

Supported scopes: `deals:read`, `documents:search`, `valuation:read`, `diligence:read`, `prospects:read`, `firm_memory:read`, `listings:read`, `deal_notes:write`, `diligence:write`, `listings:write`, `actions:stage`.

Clients default to the least-privilege `deals:read` scope when none is registered. Authorization cannot grant scopes beyond the registered client scope. Write and staged-action scopes are never granted by default, and governed writes also require the appropriate active EQUIRE role.

## Limits and recovery

The MCP endpoint, dynamic registration endpoint, and token endpoint are rate limited. Production requires durable rate-limit storage and fails closed when it is unavailable. Retry after a rate-limit response using its `Retry-After` header.

To disconnect a client, an EQUIRE operator must revoke its stored refresh tokens and dynamic client record. There is no public token-revocation endpoint.