# Provider distribution

Start with [Developer documentation](../mcp/README.md) for protocol examples,
live policy schemas, security rules, tool development and troubleshooting.

See [Native views and discovery](native-views-and-discovery.md) for the shared
MCP Apps views, outcome tools, repeatable selection evaluations, and live-provider
acceptance checklist.

The shared OAuth server supports public clients using dynamic registration, authorization-code + S256 PKCE, issuer identification, resource binding, scoped human consent, rotating refresh tokens and grant revocation.

Canonical endpoint: `https://app.retailhardhat.com/api/mcp`

Public docs, privacy, terms and support: `/api/mcp-public` and its corresponding subpages. Root OAuth discovery and OpenAI domain verification routes are mapped to the API artifact. They become available in production only when this code is published.

## Generate packages

```sh
pnpm --filter @workspace/scripts exec tsx src/mcp/package-providers.ts \
  --origin https://app.retailhardhat.com \
  --discovery-base "https://$REPLIT_DEV_DOMAIN"
```

The discovery base is only used to check live metadata while generating. Every packaged URL remains the canonical published HTTPS origin. Omit the discovery base after publishing.

Generated files live under ignored `generated-artifacts/mcp/`. The script validates portable manifest schemas, OpenAI host-auth settings and Microsoft/Registry schemas, copies existing brand icons, and creates ZIPs. It does not publish anything.

OpenAI-specific auth uses its documented `extensions.com.openai.auth`; the portable Agent Plugins MCP core schema does not yet include host extensions, so the core and host extension are checked separately.

For Microsoft, obtain the real DCR auth-config reference ID in Developer Portal and add `--copilot-registration-id ID`. Without it, generation deliberately produces only `.template.json` sources, not an unusable Copilot ZIP. The public app UUID is a stable manifest identifier, not a pre-approved Microsoft publisher registration.

Review [the checklist](review-checklist.md), including populated review accounts and real-provider tests. Code tests and metadata validation cannot prove provider approval or account eligibility.

## Test

```sh
pnpm --filter @workspace/api-server run test:unit
pnpm --filter @workspace/scripts exec vitest run --config vitest.config.ts src/e2e/mcp-oauth.test.ts
pnpm --filter @workspace/scripts exec playwright test --config playwright.config.ts src/browser/tests/20-mcp-oauth.spec.ts
pnpm run typecheck
```

Existing MCP tool, tenancy, approval and upload tests continue to apply. Run API and browser E2E sequentially because they use shared fixture cleanup.

No provider API key is needed: RetailHardHat is the OAuth authorization server, not a consumer of the providers' inference APIs.