Connect an agent to Breakout Scanner

1. 01

   Point the client at the resource URL

   Use https://breakoutscanner.com/mcp. Do not configure the Supabase issuer as the MCP server URL.

2. 02

   Let the client discover OAuth and open the browser

   The client follows protected-resource metadata, uses Authorization Code + PKCE, and requests the standard identity scopes email, openid, and profile.

3. 03

   Review the Breakout Scanner consent screen

   Choose the grant groups this connection needs. New connections use connected-client approval by default; identity scopes prove the user, while the application grant record is the fine-grained authorization decision.

4. 04

   Keep the connection visible in Agent connections

   Every call rechecks the live account, entitlement, token claims, connection status, current generation, and grants. A connection can be changed or revoked without replacing another client.

A connection with no active grants can authenticate but cannot call a tool. Umbrella grants such as workspace.read and workspace.write are explicit choices, not hidden defaults; a grant that is not mapped to a registered capability does not create a tool. Every request also requires an eligible Pro account and the relevant feature to be enabled.

Choose the client-side approval behavior that suits your workflow. Breakout Scanner does not rely on that setting for authorization: the connection’s grants, destructive-operation grant, owner scope, usage limits, and immutable journal remain enforced on every call. The legacy proposal and integration detail APIs remain agent-only; they are not rendered as human Connections-page controls.

const endpoint = new URL("https://breakoutscanner.com/mcp");
const metadataUrl = "https://breakoutscanner.com/.well-known/oauth-protected-resource/mcp";

// OAuth Authorization Code + PKCE belongs to your MCP client.
// Do not put a Supabase token or client secret in source control.
const resourceMetadata = await fetch(metadataUrl).then(async (response) => {
  if (!response.ok) throw new Error("Discovery failed: " + response.status);
  return response.json() as Promise<{
    resource: string;
    authorization_servers?: string[];
    scopes_supported?: string[];
  }>;
});

console.log(resourceMetadata.resource === endpoint.href);
console.log(resourceMetadata.scopes_supported); // email, openid, profile

const response = await fetch("https://breakoutscanner.com/mcp", {
  method: "POST",
  headers: {
    Authorization: "Bearer " + accessToken, // obtained through OAuth + PKCE
    "Content-Type": "application/json",
    Accept: "application/json, text/event-stream",
    "MCP-Protocol-Version": "2025-06-18",
  },
  body: JSON.stringify({
    jsonrpc: "2.0",
    id: 1,
    method: "tools/call",
    params: {
      name: "breakout_scanner_market_snapshot",
      arguments: { symbols: ["AAPL"], market: "NYSE", limit: 1 },
    },
  }),
});

if (!response.ok) throw new Error("MCP request failed: " + response.status);
const result = await response.text(); // JSON or an SSE stream, per client negotiation

read -r -s MCP_ACCESS_TOKEN
curl -fsS -X POST https://breakoutscanner.com/mcp \
  -H 'Accept: application/json, text/event-stream' \
  -H 'Content-Type: application/json' \
  -H 'MCP-Protocol-Version: 2025-06-18' \
  -H "Authorization: Bearer ${MCP_ACCESS_TOKEN}" \
  --data '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"release-check","version":"1"}}}'
unset MCP_ACCESS_TOKEN

Read responses are owner-scoped and include evidence, an asOf value when applicable, and limitations. A write call returns an approval or terminal journal result—not a generic direct-mutation success.

codex mcp logout breakout-scanner
codex mcp remove breakout-scanner

Codex logout removes or deauthenticates the local client credential; Claude’s connector controls its provider-side grant. Both are separate from the Breakout Scanner owner action, so revoke in the client and here when you want a complete disconnect.