Another client
Connect a client that you build, or a client with no page here — the endpoint, the transport, the protocol versions, OAuth discovery, and the discovery documents.
This page is for a developer. It gives what a client needs to connect to the AdCrunch MCP server with no guide. A client that follows the MCP specification for a remote server with OAuth needs nothing else.
The endpoint
| Endpoint | https://mcp.adcrunch.dev/mcp |
| Transport | Streamable HTTP |
| Protocol versions | 2025-11-25, 2025-06-18, 2025-03-26, 2024-11-05, 2024-10-07 |
| Capabilities | tools, prompts |
| Authorization | OAuth 2.1, with PKCE (S256) |
The server sets no instructions on initialize. The text of each tool is in tools/list.
Authorization
The endpoint accepts one credential: a bearer token that AdCrunch issued for this endpoint. An API key of the REST API does not work here.
Call the endpoint with no token
The server answers 401. Its WWW-Authenticate header names the protected resource metadata and each scope of the server:
WWW-Authenticate: Bearer resource_metadata="https://mcp.adcrunch.dev/.well-known/oauth-protected-resource", scope="asset:read asset:write brand:read brand:write campaign_plan:read campaign_plan:write mutation:write observe:read skill:read skill:write"Read the protected resource metadata
https://mcp.adcrunch.dev/.well-known/oauth-protected-resource (RFC 9728) gives the resource, https://mcp.adcrunch.dev/mcp, and one authorization server, https://auth.adcrunch.dev.
Read the authorization server metadata
https://auth.adcrunch.dev/.well-known/oauth-authorization-server (RFC 8414) gives each endpoint. Read the endpoints from this document. Do not write them into your client, because their host is not the host of the issuer.
Register the client
The server accepts dynamic client registration (RFC 7591) with no initial token. A registered client is a public client: the token endpoint takes no client secret.
Authorize
Send the person to the authorization endpoint with a PKCE challenge (S256). Ask for the service scopes that your client needs, and for offline_access to get a refresh token. The person signs in to AdCrunch and approves the access. The consent screen has no organization picker: Auth & scopes states which organization the token acts for.
Call the endpoint with the token
Send Authorization: Bearer <token> on each request. The token lives about one hour. Use the refresh token to get a new one.
The authorization response carries the iss parameter (RFC 9207), and its value is https://auth.adcrunch.dev.
When the endpoint refuses the token
These two failures happen before any tool runs, so they are HTTP answers and not tool results:
| Status | WWW-Authenticate error |
Cause | Do this |
|---|---|---|---|
401 |
invalid_token, or none |
No token, or a token that does not verify, for example an expired token. | Refresh the token, or authorize again. |
403 |
insufficient_scope |
The token holds no AdCrunch service scope: a token from before AdCrunch had scopes, or a token for OpenID Connect scopes only. | Authorize again. |
A token that holds a service scope, but not the scope of one tool, is not refused here. The call of that tool fails with the code forbidden. Errors gives the shape.
Tools and prompts
tools/list gives all 51 tools to each token. The scopes of the token do not change the list. They decide which tools can run.
Each tool carries these keys in its _meta:
| Key | Value |
|---|---|
dev.adcrunch/errors |
Each failure code that the tool can send. |
dev.adcrunch/scope |
The one service scope that the tool needs. |
dev.adcrunch/providers |
The providers that the tool works with, when a provider decides whether it works. A tool that works the same way for each provider has no such key. |
The page of each tool shows the same facts, from the same list. A failed tool call carries a code in structuredContent, as Errors states.
prompts/list gives one prompt for each playbook and for each brand of the organization. It depends on the scopes: playbooks need skill:read, and brands need brand:read. Prompts describes them.
Discovery
An agent that looks for the server before it connects can find it.
The MCP Server Card
AdCrunch publishes an MCP Server Card at three addresses, with the same content:
https://adcrunch.dev/.well-known/mcp/server-card.jsonhttps://mcp.adcrunch.dev/.well-known/mcp/server-card.jsonhttps://mcp.adcrunch.dev/mcp/server-card, the path that the proposal reserves under the endpoint.
The card names the endpoint and the protocol versions above. It lists no tools and no prompts. A connection lists them. No token is necessary to read the card.
The ARD manifest
An agent that starts from the domain alone reads https://adcrunch.dev/.well-known/ard.json first. This ARD manifest lists what AdCrunch offers an agent: this MCP server and the REST API. For each one, it gives the document that describes it and some example questions that it can answer.
The same document is at https://adcrunch.dev/.well-known/ai-catalog.json, the path that older crawlers read. The robots.txt of adcrunch.dev names that path.
The API Catalog
The REST API has an index of its own: an RFC 9727 linkset at https://adcrunch.dev/.well-known/api-catalog, and at the same path on the API origin. It names each published API and its OpenAPI document. The API reference describes the REST API.