Production MCP endpoint
https://mcp.fbplot.com/mcpTransport: Streamable HTTP; OAuth 2.1 Authorization Code + PKCE; protocol negotiation supported.
OAuth is separate from the FBPlot web session
MCP uses Authorization Code + PKCE (S256), protected-resource metadata, exact registered redirect URIs, a resource audience, short-lived access tokens, refresh rotation, and revocation. The browser session is used only to identify the account during login/consent; it is never forwarded as an MCP bearer token.
What is checked
- The account is authenticated.
- The account is active Pro or Admin.
- The requested OAuth scopes are valid.
- The token audience is the FBPlot MCP resource.
- The current subscription is still eligible on every tool call.
How to revoke
Open Account -> FBPlot MCP to revoke one connected application or all MCP grants. A client disconnect/revoke control also calls the standard OAuth revocation endpoint. Downgrading or expiring Pro access immediately prevents new tool execution and refresh.
Scopes
players:readResolve and search player identities.
stats:readRead selected FBPlot statistics.
charts:readRead your saved MCP chart metadata and signed PNG URLs.
charts:createCreate and save private charts.