OAuth & scopes
The Dataflow MCP server is its own OAuth 2.1 authorization server. Tokens are short-lived JWTs issued after login through Modular Finance SSO, with refresh tokens for long-running hosts. Dynamic client registration (RFC 7591) is supported, so most MCP hosts connect without any pre-configuration.
Scopes
Each tool requires one scope, and each scope unlocks a data domain:
| Scope | Tools |
|---|---|
dataflow:entities.search | search_securities, search_owners, get_company_peers |
dataflow:ownership.read | get_owner_list, get_sub_holdings, get_owner_portfolio, list_owner_changes, list_portfolio_changes, list_market_transactions |
dataflow:insider.read | list_insider_transactions, get_company_insiders, get_insider_holdings |
dataflow:short.read | get_short_interest, list_public_short_positions |
dataflow:buyback.read | get_buyback_program, list_buyback_transactions |
dataflow:shares.read | get_shares_outstanding |
dataflow:freefloat.read | get_free_float |
dataflow:distribution.read | get_ownership_distribution |
dataflow:lockups.read | get_lockups |
dataflow:trading.read | list_block_trades |
dataflow:calendar.read | list_corporate_actions, list_calendar_events |
Your contract determines which of these your organization can grant; tools whose scope you do not hold are not listed to your agent at all. The consent screen on first connect shows exactly what the host requested.
Scopes are re-evaluated every time a token is issued, so a scope added to or removed from your contract takes effect on the next token - within minutes, with nothing to reconnect.
Credentials
Each connected MCP host gets its own OAuth client, created for you when you connect it. For server-to-server access from your own code, ask for a machine credential instead: a client_id and client_secret your service exchanges for tokens without a browser login.
Either way, usage is attributed per credential, so you can tell your hosts and services apart in your usage breakdown and revoke one without disturbing the rest.
Discovery endpoints
Standard metadata for hosts and tooling:
/.well-known/oauth-protected-resource: resource metadata (RFC 9728)/.well-known/oauth-authorization-server: authorization-server metadata (RFC 8414)/.well-known/jwks.json: token verification keys