Remote MCP with OAuth

Most launch brokers host an MCP server that clients reach over HTTP and authorize with OAuth.

Discovery: protected-resource metadata

Four servers in our sources publish OAuth protected-resource metadata at /.well-known/oauth-protected-resource, which tells a client where to sign in and which scopes exist:

Server	Authorization server	Scopes advertised	Source
Robinhood agent.robinhood.com/mcp/trading	the same URL	internal	1
Coinbase agents.coinbase.com/mcp	login.coinbase.com	portfolios, accounts, orders, trades, transfers, products	2
Webull api.webull.com	api.webull.com	account:read, order:read, order:write, market:read, instrument:read, instruction:all	3
Public mcp.public.com	listed in metadata; product page gives https://mcp.public.com/mcp	trading.read, trading.write, marketdata, openid	45

Fine-grained scopes (Coinbase, Webull) let a client ask for less than full access. A single broad scope (Robinhood’s internal) means account-level settings do the limiting instead.

Public also documents a Claude and Claude Code connector for its MCP, and an official changelog entry covers Grok MCP connector setup with OAuth.⁶⁷

Client registration

• Robinhood: an independent test found a dynamic client registration endpoint and PKCE.⁸
• Coinbase: supports Dynamic Client Registration and Client ID Metadata Documents, but still allowlists clients; registration does not grant every scope or tool.⁹
• Alpaca: hosted MCP setups ship fixed OAuth client IDs per client app.¹⁰

Builder notes

• Read the metadata before you build a consent screen; it tells you what a token can do.
• Expect allowlisting. A working registration call does not mean your client may trade.⁹

Sources

---

Suggest a correction (opens a GitHub issue)

Footnotes

1. Robinhood Trading MCP: OAuth protected-resource metadata. Robinhood (endpoint metadata), official, retrieved 2026-11-12. ↩

2. Coinbase for Agents MCP: OAuth protected-resource metadata. Coinbase (endpoint metadata), official, retrieved 2026-11-12. ↩

3. Webull API: OAuth protected-resource metadata. Webull (endpoint metadata), official, retrieved 2026-11-12. ↩

4. Public MCP: OAuth protected-resource metadata. Public.com (endpoint metadata), official, retrieved 2026-11-12. ↩

5. Public MCP Server for trading on AI platforms. Public.com, official, retrieved 2026-11-12. ↩

6. Claude & Claude Code Connector for Stock & Options Trading on Public MCP. Public.com API docs, official, retrieved 2026-11-12. ↩

7. Public Trading API Changelog - Latest Updates & Release Notes. Public.com API docs, official, retrieved 2026-11-12. ↩

8. Robinhood MCP Server: What 73 Tools and an OAuth Handshake Look Like Up Close — DeskTested. DeskTested, third-party, retrieved 2026-11-12. ↩

9. Coinbase MCP - Coinbase Developer Documentation. Coinbase Developer Platform, official, retrieved 2026-11-12. ↩ ↩²

10. GitHub - alpacahq/agentic: Multi-platform plugin marketplace for Alpaca APIs · GitHub. Alpaca (GitHub), official, retrieved 2026-11-12. ↩