{"status":"ok","message":"Tradly MCP is ready. First reuse this MCP client's saved Tradly connection across conversations and refresh it when needed; do not start a new device login just because a new chat began. Start consent only if no saved grant exists, refresh fails because the grant is invalid or revoked, or the requested scope is missing. Send POST requests with { tool, args } payload.","authentication":{"documentation":"https://mcp.tradly.app/oauth/help","discovery":"https://mcp.tradly.app/.well-known/oauth-authorization-server","credential_reuse":{"instructions":["Before starting authorization, check this MCP client's secure credential store for an existing Tradly grant and reuse that connection across conversations and agent runs.","An expired access token alone does not require a new login. Refresh it with the saved refresh token, then persist the replacement refresh token returned by OAuth.","Do not ask the user to create, retrieve, or paste access or refresh tokens. The MCP client manages token storage; the Stars server does not keep a separate reusable client session.","Start a new consent flow only when no saved grant exists, refresh fails because the grant was revoked or expired, or the requested operation requires a scope that is not already granted. For added scopes, explain the specific permission and request approval once."]},"browser_oauth":{"grant_type":"authorization_code","pkce_method":"S256","instructions":"Discover authorization_endpoint and token_endpoint, then complete browser OAuth with PKCE. An existing sign-in session may avoid a second credential prompt."},"device_login":{"additional_method":true,"grant_type":"urn:ietf:params:oauth:grant-type:device_code","device_authorization_endpoint":"https://mcp.tradly.app/oauth/device/code","device_token_endpoint":"https://mcp.tradly.app/oauth/device/token","token_endpoint":"https://mcp.tradly.app/oauth/token","terminal_client_id":"52507989-1a39-41f0-9b98-b532eff51d42","steps":["Use a registered client ID enabled for device login. For the built-in terminal flow, terminal_client_id can be used when supplied. Independent integrations can register their own client with the device-code grant explicitly enabled.","POST client_id and the minimum required scope to device_authorization_endpoint. Use application/x-www-form-urlencoded or JSON. Confidential clients must authenticate with their own client credentials; never ask the user to paste secrets into chat.","Show verification_uri_complete to the user, or verification_uri and user_code if the complete URL is absent. The user must open the page and approve manually; do not automate approval.","Poll device_token_endpoint with the same client_id, the returned device_code, and grant_type=urn:ietf:params:oauth:grant-type:device_code. Wait at least interval seconds. Continue on authorization_pending; on slow_down increase the interval by at least five seconds. Stop on denial or expiration.","Store returned access and refresh tokens securely. Call MCP using Authorization: Bearer <access_token>. Never print or commit tokens, pass them as tool arguments, or place them in URLs.","When the access token expires, POST grant_type=refresh_token, client_id and refresh_token to token_endpoint, authenticating confidential clients with their own credentials. Save every replacement refresh token. Reauthorize only when the grant is expired/revoked, credentials are lost, or additional permission is needed."]}}}