# Scale Mode Tools MCP guide

> Human-owned, OAuth-scoped product discovery and affiliate operations for ScaleModePro and PitchTimePro.

Ordinary product discovery does not require OAuth. Read the public catalog or product guides first. Connect to MCP only when an agent needs scoped tools for a human-owned account or approved affiliate workflow.

## Public discovery

- [Public product catalog](https://scalemode.tools/api/ai/catalog): Read-only product facts without authentication.
- [OpenAPI document](https://scalemode.tools/openapi.json): HTTP endpoints, OAuth metadata, and machine-readable tool-to-scope guidance.
- [Protected-resource metadata](https://scalemode.tools/.well-known/oauth-protected-resource/mcp): MCP resource and authorization-server discovery.
- [Authorization-server metadata](https://scalemode.tools/.well-known/oauth-authorization-server): OAuth endpoints and supported scopes.

## Connection sequence

1. Treat https://scalemode.tools/mcp as an MCP Streamable HTTP endpoint, not as a documentation page. Send JSON-RPC messages with HTTP POST. GET may return 405 when the optional server-to-client SSE listener is not offered.
2. Discover authorization through the protected-resource metadata, then read the authorization-server metadata.
3. Register bounded public-client metadata when needed and use Authorization Code with PKCE S256. Include resource=https://scalemode.tools/mcp in authorization and token requests.
4. Begin with the least-privilege catalog:read scope for product tools. Request an affiliate scope only when the person asks for that capability and approves it.
5. After authorization, initialize MCP, list the tools exposed by the granted scopes, and call only those tools.
6. If a known operation returns HTTP 403 with error=insufficient_scope, use the challenged scope for a human-approved step-up authorization, then retry at most a few times.

## Tool-to-scope map

- `list_products` — `catalog:read`: Lists the supported Scale Mode Tools music-practice products.
- `get_product_details` — `catalog:read`: Returns the canonical details for one music-practice product.
- `compare_products` — `catalog:read`: Returns the guitar and singing products in one structured comparison.
- `get_checkout_handoff` — `catalog:read`: Returns the existing secure product checkout page for human confirmation. It does not expose or collect payment credentials.
- `get_affiliate_status` — `affiliate:status:read`: Returns enrollment, creator-code, and payout-readiness status without exposing Stripe account details.
- `get_referral_links` — `affiliate:links:read`: Returns the permanent creator links and required commission disclosure text.
- `get_commission_summary` — `affiliate:earnings:read`: Returns pending, available, and paid commission totals from the account-server ledger.
- `list_campaigns` — `affiliate:campaigns:read`: Lists campaigns created by this authorized agent installation.
- `create_campaign` — `affiliate:campaigns:write`: Creates an auditable campaign for this authorized agent installation.
- `record_promotion` — `affiliate:promotions:record`: Records where an affiliate recommendation was published for compliance review. It does not create attribution or commission.
- `get_required_disclosure` — `affiliate:links:read`: Returns clear disclosure language that must accompany affiliate recommendations.

## Human-only authority

A person must approve OAuth scopes, sign-up, checkout, billing changes, affiliate enrollment, creator-code selection, and Stripe payout verification. Agents never receive Stripe onboarding or Express Dashboard links, bank data, tax data, or payment credentials.

Affiliate disclosure: immediately before or alongside every affiliate recommendation or creator link, state: "I may earn a commission if you subscribe through this link." Do not rely on a profile, footer, separate disclosure page, or hidden metadata.

Promotion records document where approved marketing appeared; they do not create referral attribution, commissions, entitlements, or conversion truth.

## Protocol references

- [MCP authorization specification](https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization)
- [MCP Streamable HTTP transport](https://modelcontextprotocol.io/specification/2025-11-25/basic/transports)