# optimizely probes, 2026-09-17T16:15Z, from a cloud container (one IP), no credentials, no payment
# Bodies are cut at 1500 bytes. Nothing here was sent with a credential.

## 1. MCP initialize, POST https://exp.mcp.opal.optimizely.com/mcp
$ curl -sS -i -m 25 -X POST https://exp.mcp.opal.optimizely.com/mcp -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' -d '<initialize>'
HTTP/1.1 200 Connection Established

HTTP/2 401 
www-authenticate: Bearer realm="exp.mcp.opal.optimizely.com", resource_metadata="https://exp.mcp.opal.optimizely.com/.well-known/oauth-protected-resource"
content-type: application/json
x-request-id: 04e10fc9-8c36-40cc-8c36-e3d93b7b86b0
x-cloud-trace-context: 045af534d7b3ad04d77061e41c334538;o=1
date: Thu, 17 Sep 2026 16:15:19 GMT
server: Google Frontend
content-length: 37
via: 1.1 google
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=2592000

{"detail":"Authentication required."}

## 2. Protected-resource metadata, GET https://exp.mcp.opal.optimizely.com/.well-known/oauth-protected-resource
HTTP/1.1 200 Connection Established

HTTP/2 200 
content-type: application/json
x-request-id: fd8f7a86-cbde-45fc-bfca-6a955596a6cc
x-cloud-trace-context: 2ae020b6f033f0f6f7f43a4ca47aa679;o=1
date: Thu, 17 Sep 2026 16:15:19 GMT
server: Google Frontend
content-length: 186
via: 1.1 google
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=2592000

{"resource":"https://exp.mcp.opal.optimizely.com","authorization_servers":["https://auth.mcp.opal.optimizely.com"],"scopes_supported":["mcp:tools"],"bearer_methods_supported":["header"]}

## 3. Authorization-server metadata, GET https://auth.mcp.opal.optimizely.com/.well-known/oauth-authorization-server
HTTP/1.1 200 Connection Established

HTTP/2 200 
cache-control: public, max-age=3600
content-security-policy: default-src 'none'; frame-ancestors 'none'
content-type: application/json
permissions-policy: geolocation=(), microphone=(), camera=()
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
x-frame-options: DENY
x-request-id: 1d7503d9-9924-448b-bb8e-16f017149156
x-cloud-trace-context: eb9624286204905a2cb900a3ec84b5fc;o=1
date: Thu, 17 Sep 2026 16:15:20 GMT
server: Google Frontend
content-length: 771
via: 1.1 google
alt-svc: h3=":443"; ma=2592000

{"issuer":"https://auth.mcp.opal.optimizely.com","authorization_endpoint":"https://auth.mcp.opal.optimizely.com/oauth/authorize","token_endpoint":"https://auth.mcp.opal.optimizely.com/oauth/token","registration_endpoint":"https://auth.mcp.opal.optimizely.com/oauth/register","revocation_endpoint":"https://auth.mcp.opal.optimizely.com/oauth/revoke","jwks_uri":"https://auth.mcp.opal.optimizely.com/.well-known/jwks.json","scopes_supported":["openid","profile","email","offline_access","mcp:tools"],"response_types_supported":["code"],"response_modes_supported":["query"],"grant_types_supported":["authorization_code","refresh_token"],"token_endpoint_auth_methods_supported":["client_secret_basic","client_secret_post","none"],"code_challenge_methods_supported":["S256"]}


## 4. REST, GET https://api.optimizely.com/v2/projects, no Authorization header
HTTP/1.1 200 Connection Established

HTTP/2 401 
server: nginx
date: Thu, 17 Sep 2026 16:15:21 GMT
content-type: application/json
content-length: 122
x-request-id: ac371fb3-45c4-468d-8057-6313cc7e2eec
x-frame-options: DENY
content-security-policy: frame-ancestors 'none'
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
cache-control: no-store
pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

{"code": "invalid_credentials", "message": "Missing authorization header", "uuid": "97f06964-e498-46fb-a9b7-407d3c48faae"}