# growthbook probes, 2026-09-17T16:15Z, from a cloud container (one IP), no credentials, no payment
# Bodies are cut at 1500 bytes. Nothing here was sent with a credential.

## 1. MCP initialize, POST https://mcp.growthbook.io/mcp
$ curl -sS -i -m 25 -X POST https://mcp.growthbook.io/mcp -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' -d '<initialize>'
HTTP/1.1 200 Connection Established

HTTP/2 401 
date: Thu, 17 Sep 2026 16:15:19 GMT
content-type: application/json; charset=utf-8
content-length: 134
x-powered-by: Express
www-authenticate: Bearer realm="GrowthBook MCP", resource_metadata="https://mcp.growthbook.io/.well-known/oauth-protected-resource/mcp"
etag: W/"86-LEdH9xZRmDwogOdZEurus3ysKrs"

{"error":"unauthorized","error_description":"Bearer token required. Discover the authorization server via the resource_metadata URL."}

## 2. Protected-resource metadata, GET https://mcp.growthbook.io/.well-known/oauth-protected-resource/mcp
HTTP/1.1 200 Connection Established

HTTP/2 200 
date: Thu, 17 Sep 2026 16:15:19 GMT
content-type: application/json; charset=utf-8
content-length: 272
x-powered-by: Express
etag: W/"110-v6oXk5EvF4Moi/JdLZQr6Ssq+3Q"

{"resource":"https://mcp.growthbook.io/mcp","authorization_servers":["https://api.growthbook.io"],"bearer_methods_supported":["header"],"scopes_supported":["openid","profile","email","offline_access"],"resource_documentation":"https://docs.growthbook.io/integrations/mcp"}

## 3. Authorization-server metadata, GET https://api.growthbook.io/.well-known/oauth-authorization-server
HTTP/1.1 200 Connection Established

HTTP/2 200 
date: Thu, 17 Sep 2026 16:15:20 GMT
content-type: application/json; charset=utf-8
content-length: 551
x-powered-by: Express
vary: Origin, Accept-Encoding
access-control-allow-credentials: true
access-control-allow-origin: *
etag: W/"227-F4y+lQ6MuziLkGoTgKLG6tRLM2w"

{"issuer":"https://api.growthbook.io","authorization_endpoint":"https://app.growthbook.io/oauth/authorize","token_endpoint":"https://api.growthbook.io/oauth/token","registration_endpoint":"https://api.growthbook.io/oauth/register","revocation_endpoint":"https://api.growthbook.io/oauth/revoke","response_types_supported":["code"],"grant_types_supported":["authorization_code","refresh_token"],"code_challenge_methods_supported":["S256"],"token_endpoint_auth_methods_supported":["none"],"scopes_supported":["openid","profile","email","offline_access"]}

## 4. REST, GET https://api.growthbook.io/api/v1/features, no Authorization header
HTTP/1.1 200 Connection Established

HTTP/2 400 
date: Thu, 17 Sep 2026 16:15:21 GMT
content-type: application/json; charset=utf-8
content-length: 42
x-powered-by: Express
access-control-allow-origin: *
etag: W/"2a-iFsJpqmI6j4cVwQiO6Ty2gZ3ejY"
vary: Accept-Encoding

{"message":"Missing Authorization header"}