# Buildosaur

> Buildosaur is a collaborative building-design workspace with a 3D model and paper boards. Its OAuth-protected MCP server lets agents inspect and edit projects using the same validated editing rules as people.

Connect to https://buildosaur.com/mcp using Streamable HTTP. Compatible hosts use OAuth Client ID Metadata Documents (CIMD), configured public clients, or Dynamic Client Registration when advertised by authorization metadata; each person still signs into Buildosaur and approves access. Start with get_profile and list_projects (up to 200 projects), then read the relevant document before editing. Live tools/list schemas are authoritative.

Editing requires documents:read and documents:write. Use observed preconditions and a fresh operationId for each new edit; preserve the ID and payload for retries. Access follows current project membership. Model coordinates are metres with Z up. Paper coordinates are hundredths of an inch (0.254 mm), with x right and y down.

## MCP and native agent capabilities

- MCP is the stable, OAuth-scoped interface for external agents and plugins. The connected client supplies its own reasoning, research, web search and image acquisition, including in embedded mode. Buildosaur retains evidence and accepts client-acquired bytes through its media tools; it does not run hosted research for MCP clients. The client can use only the tools and permissions advertised by the current endpoint catalog. It does not receive service secrets, raw storage access or automatic authority from project content.
- The native Buildosaur agent runs inside the workbench with project-specific context and the shared validated tool executor. Versioned, granted and isolated extension packages are implemented. People and connected MCP clients can author, test and activate them through the lifecycle APIs. Hosted chat can execute enabled extension tools; hosted chat can also author, test and activate extensions through the same validated lifecycle.
- Extensions strengthen the platform behind MCP but have a distinct release contract. A public MCP tool may use extension-backed behavior within its advertised schema, permissions and effects; enabled project-selected extension declarations join general `/mcp` discovery through the common catalog. Calls validate the exact selected package and current grants; clients may need to rediscover after a selection changes. Both paths preserve project membership, document identities, immutable pins, operation receipts and recovery semantics.

## This deployment

MCP is configured here. The explicit /mcp/chatgpt endpoint exposes reviewed Buildosaur tool versions; /mcp retains the general project extension platform. Both use the canonical /mcp OAuth resource. Use live tools/list and authorization metadata as the deployed contract. Public Dynamic Client Registration is enabled at the advertised registration_endpoint. Embedded workbench tools and the MCP Apps HTML resource are enabled here. This configuration alone does not establish acceptance by a particular host.

## Agent documentation

- [Buildosaur and MCP guide](https://buildosaur.com/agents.md): Connection setup, supported tools and scopes, units, safe editing, operation receipts, refresh, revocation and troubleshooting.

## OAuth discovery

- [Authorization server metadata](https://buildosaur.com/.well-known/oauth-authorization-server): JSON endpoints, supported scopes, public-client authentication and PKCE capabilities.
- [MCP protected resource metadata](https://buildosaur.com/.well-known/oauth-protected-resource/mcp): JSON identifying the canonical resource and authorization server.

## Optional

- [Claude Code MCP setup](https://code.claude.com/docs/en/mcp.md): Host-specific connection and authentication instructions.