May 2, 2026

HTTP MCP server, OAuth 2.0 with Dynamic Client Registration

greyout is now agent-native. Any MCP-aware AI tool — Claude Code, Claude.ai, Cursor, Aider, custom — can connect with a single URL and run real monitoring workflows.

What's live

  • https://mcp.greyout.io/mcp — hosted HTTP MCP server (Streamable HTTP transport, JSON-RPC 2.0) with auto-renewing TLS.
  • OAuth 2.0 Authorization Server at app.greyout.io with three flows: Authorization Code + PKCE (browser MCP clients), Device Grant (terminal CLIs), Refresh Token (silent rotation).
  • Dynamic Client Registration (RFC 7591) — clients self-register without a human in the loop on our side.
  • Discovery via standard metadata documents: /.well-known/oauth-protected-resource (RFC 9728) and /.well-known/oauth-authorization-server (RFC 8414).
  • Per-device permission management — grant or revoke individual scopes from Settings → Authorized devices without disconnecting the whole device.

What changed for you

The earlier per-token spending cap is gone. greyout's plans are subscription tiers (binary moves between Starter / Pro / Business), so a metered cap was complexity without product value. Billing actions are now gated purely by the billing:authorize scope — granted to a device only if you tick the box on the consent screen (off by default for safety).

Documentation