- OAuth read+write on /mcp; API key on /mcp still full internal tools (LAN) - /readonly/mcp and /oauth/mcp remain OAuth aliases - OAuth metadata and connector_url point to /mcp - README + Traefik template: route Host without blocking /mcp
Scope-gated tools on one Streamable HTTP URL; /oauth/mcp alias. Reconnect Claude once with ctxd.read ctxd.write.