MCP.Market

Tollbooth Oauth2 Collector MCP server

online · 100% uptime
by lonniev·io.github.lonniev/tollbooth-oauth2-collector·v0.2.12
No reviews yet

Unauthenticated OAuth2 callback collector for Tollbooth MCP services

A91/100grade A
Write a reviewRun it
What users say
No reviews yet
Be the first
Safety scan
A91/100

full report

Adoption
New

0 stars

Reviews

Write one

Nobody has reviewed Tollbooth Oauth2 Collector yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Tollbooth Oauth2 Collector tools (4)

write = sends, deletes, buys or posts
  • collector_statusFree

    Health check — shows the number of pending authorization codes and TTL.

  • retrieve_codeFree

    Retrieve a stored authorization code (one-time read, auto-deleted). Called by the originating MCP server to pick up the code after the user has authorized in the browser. Returns the encrypted code which the caller decrypts using the same state token.

  • service_statusFree

    Report the running build so a redeploy can be verified. Free. Delegates to the SDK's canonical ``build_service_status`` — the single source of the service_status payload shape — so this collector reports the same envelope as every other DPYC service. The load-bearing field is ``build_info.fastmcp_cloud_git_commit_sha``: the commit Horizon actually deployed. The post-merge deploy-verify probe reads it to confirm the live service redeployed the merged sha; with no ``service_status`` tool to probe, that sha reads as ``<none>`` and an otherwise-healthy deploy is flagged as "did not land". The vault/courier/operator fields are ``False``/empty by construction — this is an unauthenticated community utility with no operator runtime.

  • store_codeFree

    Store a sealed OAuth2 authorization code. Called by the serverless callback function after the browser redirect. The ``state`` carries BOTH the patron npub (the lookup/retrieve key) and the operator npub (the PUBLIC key the code is sealed to) — see the SDK's ``pack_oauth_state``. The code is sealed with NIP-44 to the operator so only that operator's nsec can open it; the Neon row is keyed by the patron npub, so retrieval (``retrieve_code(state=patron_npub)``) is unchanged.

Public scan report

scanner v0.1.10 · 2026-10-31 · same rubric, same numbers if you re-run it

no findings
  • –Code scanremote-only server, no package to scann/a
  • Live reliabilityremote reachable in 1428ms20/20
  • Tool poisoning4 tool descriptions checked15/15
  • Auth qualityopen endpoint, read-only tools10/15
  • Maintenancelast push 2 days ago15/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
Overall 91/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Tollbooth Oauth2 Collector compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
91/100
higher than 85% of 48,255 servers
Tools
4
the typical server has 7
Tools that change things
0%
typical: 0%. Fewer write tools means less an agent can break
Uptime
100%
of our recent checks; the typical remote server answers 100%
Response time
517 ms
faster than 28% of 30,031 servers

What its tools let an agent do: 4 read

Release history: 2 versions in the registry since 2026-08-24, latest 2026-10-21, typically one every 58 days.

Install Tollbooth Oauth2 Collector in Claude Code, Cursor or VS Code

claude mcp add --transport http tollbooth-oauth2-collector https://tollbooth-oauth2-collector.fastmcp.app/mcp
Add to Cursor

What the publisher says

From the Tollbooth Oauth2 Collector repository's README, as published. We do not edit it. Read it on GitHub

Tollbooth OAuth2 Collector

An unauthenticated "dumb mailbox" FastMCP server that holds OAuth2 authorization codes for retrieval by the originating MCP server. A companion serverless function (Val Town) receives the browser redirect from the OAuth provider and hands the code to this collector's storecode MCP tool. This two-part design works around Horizon proxying only POST traffic on the /mcp/ path — browser GET redirects from OAuth providers cannot reach @mcp.customroute endpoints, so a serverless callback bridges the gap.

How It Works

┌───────────────┐   1. redirect_uri → serverless    ┌──────────────────────┐
│ OAuth Provider│ ─────────────────────────────────→│ Serverless callback  │
│ (e.g. Schwab) │   GET ?code=AUTH_CODE&state=TOKEN  │ (Val Town)           │
└───────────────┘                                    └──────────────────────┘
                                                               │
                                        2. POST store_code     │
                                           (JSON-RPC /mcp/)     ▼
                                                     ┌──────────────────────┐
                                                     │ OAuth2 Collector     │
                                                     │ store_code tool      │
                                                     │ → encrypts + Postgres│
                                                     └──────────────────────┘
                                                               │
                                                               │ 3. code stored
                                                               ▼
┌──────────────┐   4. retrieve_code(state=TOKEN)     ┌──────────────────────┐
│ MCP Server   │
  1. MCP server starts an OAuth flow, setting redirect_uri to the serverless callback function's URL
  2. User authorizes in the browser; the OAuth provider redirects to the serverless callback with ?code=...&state=...
  3. Serverless callback (Val Town) POSTs the code to the collector's store_code MCP tool over /mcp/
  4. Collector encrypts the code (AES-256-GCM keyed on SHA-256 of the state) and stores it in Postgres (600s TTL)
  5. MCP server calls the retrieve_code(state=...) MCP tool to pick up the code (one-time read, auto-deleted)
  6. MCP server decrypts and exchanges the code for a token using its own credentials

The collector also exposes collectorstatus (pending-code count and TTL) and servicestatus (deployed build, incl. git sha) as free MCP tools. The serverless callback source lives in val/oauth_callback.js.

Deployment

Deploy to Horizon:

fastmcp deploy server.py

Set the NEONDATABASEURL environment variable in Horizon to point to your Neon Postgres instance.

DPYC Advocate Identity

This collector is registered as an Advocate in the DPYC Social Contract. Consuming MCP servers discover its URL automatically via the DPYC registry:

from tollbooth.registry import resolve_service_by_name

svc = await resolve_service_by_name("tollbooth-oauth2-collector")
collector_url = svc["url"]  # e.g., "https://tollbooth-oauth2-collector.fastmcp.app"

No OAUTHCOLLECTORURL env var needed — peer discovery is handled by the registry.

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Tollbooth Oauth2 Collector: common questions

Is Tollbooth Oauth2 Collector MCP server safe?
Yes, by our scan: it is graded A (91/100). Read the Tollbooth Oauth2 Collector safety report
How do I install Tollbooth Oauth2 Collector?
It runs remotely at tollbooth-oauth2-collector.fastmcp.app. Add it to Claude Code, Cursor, VS Code or Claude Desktop with the snippets above, or call it through the mcp.market gateway without installing anything.
Does Tollbooth Oauth2 Collector need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is Tollbooth Oauth2 Collector maintained?
The last commit was 6 days ago (2026-10-29). The latest release is v0.2.12.
Is Tollbooth Oauth2 Collector up?
100% of our last 28 checks got an answer. We check remote servers about four times a day.
How does Tollbooth Oauth2 Collector compare with other MCP servers?
safety score 91/100 (higher than 85% of 48,255 servers); tools 4 (the typical server has 7); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.

More from lonniev →