Is MCP live for every agent client?

Any client that speaks Streamable HTTP MCP can connect today, with OAuth or an API key. What is not live is one-click directory distribution: Brandloop is not listed in the Claude connectors directory, Anthropic's desktop-extension directory, or the ChatGPT app directory, so each client adds it as a custom connector.

Does connecting require a client ID or secret from Brandloop?

No. The authorization server supports dynamic client registration, so an MCP client registers itself and then asks you to approve the requested scopes on a Brandloop consent screen. API keys remain available for scripts and CI.

Can MCP skip content approval?

No. Brandloop's public positioning keeps human review and workspace controls in the loop.

Docs / MCP

Brandloop MCP documentation

Brandloop's remote MCP endpoint is https://brandloop.app/api/mcp. It accepts either an OAuth 2.1 access token, which any MCP client can obtain itself through PKCE and dynamic client registration, or a Brandloop API key sent as a bearer token. Brandloop is not yet listed in the Claude or ChatGPT connector directories, so it is added as a custom connector rather than installed in one click.

Public reference

https://brandloop.app/docs/mcp

Agent-readable index

What MCP is for

The curated MCP surface maps scoped Brandloop operations for brand sources, assets, generation profiles, and generation jobs. It does not expose billing, admin, provider-secret, or destructive tools.

How clients authenticate

Both paths reach the same curated tools with the same scopes. An unauthenticated request answers 401 with a WWW-Authenticate header pointing at the protected-resource metadata, which is the discovery route MCP clients follow on their own. Access tokens are short-lived and audience-bound to https://brandloop.app/api/mcp; refresh and revocation are supported. Mutating tools accept an optional idempotencyKey; when it is omitted, the server derives a deterministic key from the complete normalized tool input so identical retries stay safe.

OAuth 2.1, PKCE-only, with a consent screen on your Brandloop session.
Dynamic client registration, so a client needs no pre-shared credentials.
RFC 8414 authorization-server metadata and RFC 9728 protected-resource metadata, at the well-known paths below.
API-key bearer tokens keep working in parallel for CI, scripts, and local installs.

Distribution boundary

Directory distribution is not finished. Brandloop is not listed in the Claude connectors directory, is not submitted to Anthropic's desktop-extension directory, and has not completed ChatGPT app review, so each client connects to the remote endpoint as a custom connector. The stdio server has no public package; it is packaged as a desktop extension for internal installs.

Custom-connector setup works today; one-click directory install does not exist yet.
The MCP Registry entry is prepared but not yet published.
A durable Brandloop agent runtime is planned, not implemented.

Agent safety

MCP clients should preserve approval gates, workspace scope, and API-key limits. They should not bypass Brandloop review, billing, channel, or provider controls.

Use Brandloop scopes and account boundaries.
Keep generated work reviewable.
Do not expose provider secrets to MCP clients.

Curated MCP tools

Curated MCP tools
Tool	Access	What it does
whoami	Read	Confirm which Brandloop account and workspace this connection acts on
brand_source_submit	Write	Submit a public brand source URL (website or social profile) for Brandloop to fetch and analyze
brand_source_get	Read	Fetch a previously submitted brand source by id
asset_list	Read	List Brandloop media assets scoped to the API key's account and workspace
asset_upload	Write	Create a Brandloop asset
asset_upload_complete	Write	Verify a previously created Brandloop asset upload and mark it uploaded or ready
asset_get	Read	Fetch a Brandloop media asset by id, including a short-lived signed download URL when one is available
generation_profiles_list	Read	List Brandloop-owned generation profile aliases available to this API key
generation_create	Write	Start a Brandloop media generation job for a selected Brandloop workflow; this may consume account credits and invokes Brandloop generation infrastructure
generation_get	Read	Fetch a Brandloop media generation job by id

Claude Code

bash

Omit the header to let Claude Code run the OAuth flow itself; pass it to use an existing API key instead.

claude mcp add --transport http brandloop https://brandloop.app/api/mcp

# Or with an API key, for a non-interactive environment:
claude mcp add --transport http brandloop https://brandloop.app/api/mcp \
  --header "Authorization: Bearer $BRANDLOOP_API_KEY"

Claude Desktop and claude.ai

text

Added as a custom connector until Brandloop is listed in the connectors directory. The client discovers the authorization server from the endpoint's own metadata, registers itself, and shows a Brandloop consent screen.

Settings -> Connectors -> Add custom connector

Remote MCP server URL: https://brandloop.app/api/mcp
Authentication:        OAuth (no client ID or secret to enter)

Cursor

json

In ~/.cursor/mcp.json. Drop the headers block to use OAuth instead of a key.

{
  "mcpServers": {
    "brandloop": {
      "url": "https://brandloop.app/api/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_BRANDLOOP_API_KEY"
      }
    }
  }
}

Discover the OAuth surface

http

What an MCP client does on its own: an unauthenticated call answers 401 and names its metadata document, which links the authorization server.

POST /api/mcp HTTP/1.1
Host: brandloop.app
Accept: application/json, text/event-stream
Content-Type: application/json

{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer realm="mcp",
  resource_metadata="https://brandloop.app/.well-known/oauth-protected-resource"

GET /.well-known/oauth-protected-resource/api/mcp   # this resource, its scopes
GET /.well-known/oauth-authorization-server          # PKCE, registration, token

Call a tool with an API key

http

The API-key path stays supported in parallel with OAuth, for CI and scripts.

POST /api/mcp HTTP/1.1
Host: brandloop.app
Authorization: Bearer $BRANDLOOP_API_KEY
Accept: application/json, text/event-stream
Content-Type: application/json

{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}

Limitations and boundaries

MCP is not a claim of universal unattended publishing.
MCP clients do not receive raw generation, channel, billing, or storage provider credentials.
Remote MCP supports OAuth 2.1 and API-key bearer tokens, but Brandloop is not yet a directory-listed one-click Claude or ChatGPT connector.

Common questions

Is MCP live for every agent client?: Any client that speaks Streamable HTTP MCP can connect today, with OAuth or an API key. What is not live is one-click directory distribution: Brandloop is not listed in the Claude connectors directory, Anthropic's desktop-extension directory, or the ChatGPT app directory, so each client adds it as a custom connector.
Does connecting require a client ID or secret from Brandloop?: No. The authorization server supports dynamic client registration, so an MCP client registers itself and then asks you to approve the requested scopes on a Brandloop consent screen. API keys remain available for scripts and CI.
Can MCP skip content approval?: No. Brandloop's public positioning keeps human review and workspace controls in the loop.

Continue with related references

MCP marketing automationBuyer-facing MCP page.API docsAPI-key and contract documentation.Security docsCredential and crawler boundaries.Product markdownAgent-readable product summary.