Fanflet MCP and OAuth

What the speaker portal MCP can do

A signed-in speaker on Pro, Studio, or Early Access can connect Claude to https://fanflet.com/api/mcp and have it work inside that speaker's own account. The server is live in production. It speaks MCP over Streamable HTTP and signs the speaker in with OAuth 2.1 and PKCE. There is no API key to paste in, and there is no public sandbox.

Attendees still scan a QR code. This server is not a public dump of public profiles or fanflet pages, and those pages are not offered for model training.

Speaker tools

These eighteen tools are the speaker connection. Each speaker tool runs as the signed-in speaker, under that account's plan limits.

• speaker_get_profile — name, bio, public slug, photo URL
• speaker_get_plan_info — plan name, limits, and features
• speaker_list_fanflets — drafts, scheduled, published, or archived
• speaker_get_fanflet — one fanflet and its resource blocks
• speaker_create_fanflet — a new draft
• speaker_add_resource_block — a link, text, or sponsor block. This does not upload a file.
• speaker_list_library_items — items already in the speaker's library
• speaker_add_library_block — attach one of those items. Sponsor library items are refused.
• speaker_delete_resource_block
• speaker_publish_fanflet — publishes and returns the public URL, the permanent /f/{id} URL, and the existing QR image at /api/qr/{id}
• speaker_schedule_fanflet — Studio only. Queues a draft to go live at a future time. The page stays private until then.
• speaker_unpublish_fanflet — back to draft
• speaker_get_subscriber_count — the total, plus a count per fanflet. It is not broken out by week.
• speaker_get_impact — page views, resource clicks, subscribers, and the top clicked resources. Totals only. No visitor list and no subscriber emails.
• speaker_list_feedback_packs and speaker_get_feedback_pack — packs this speaker already saved, and the question text in order. No answers.
• speaker_attach_feedback_pack — put one existing pack on a draft or a scheduled page. A public page is refused.
• fanflet_list_workspaces — id, type, and name of the profiles this connection may use.

Connect Claude

Claude on the web, Claude Desktop, and Cowork use the same custom connector. The callback https://claude.ai/api/mcp/auth_callback is allowlisted. Claude Code can use an http://localhost callback, which is also allowlisted.

The same URL is on User settings → AI assistants. Connecting is shown on every plan. On Free, connecting succeeds and the next call returns 403 until the plan includes MCP access.

Connect ChatGPT

In ChatGPT, open Settings, then Apps or Connectors, and create a connector. Paste https://fanflet.com/api/mcp. Sign in when Fanflet asks, then choose the profiles this agent may use. At least one. One profile is used automatically. If you allow more than one, the agent passes workspaceId. ChatGPT may redirect to https://chatgpt.com/connector/oauth/{callback_id} or to the stable callback https://chatgpt.com/connector_platform_oauth_redirect. Both are allowlisted. The login redirect includes iss so ChatGPT can use the stable callback.

Timed queueing is Studio. On Pro or Early Access the same create steps leave drafts, and speaker_schedule_fanflet explains that instead of setting a time. Publishing still happens only when someone calls speaker_publish_fanflet or the scheduled time arrives.

Cursor's remote connector is still refused. It registers cursor://anysphere.cursor-mcp/oauth/callback and https://www.cursor.com/agents/mcp/oauth/callback, and every redirect in a registration must be allowlisted. Neither of those is.

Whose tools you get

The OAuth scope a client requests is stored and then ignored. After sign-in, Fanflet asks which profiles this agent may use: speaker profiles you own, and sponsor organizations you can access as an owner or teammate. Pick at least one. If you have only one profile, that profile is used on every call and workspaceId is optional. If you allow more than one, pass workspaceId. fanflet_list_workspaces returns the id, type, and name of each one.

New connections use only the profiles that were checked. The older order — platform admin, then a single live sponsor organization this login can access, then speaker, then audience — applies only to connections made before this chooser, when the token has no profile list. Claude and ChatGPT do not send the dashboard's active-workspace hint, so one of those older connections for a person with exactly one live sponsor organization receives sponsor tools even if they also have a speaker profile. More than one live sponsor organization, with no profile list, does not pick an organization.

• Sponsor — sponsor_get_profile, sponsor_list_connections, sponsor_list_resources, and sponsor_get_analytics. Analytics uses the same windows as the sponsor dashboard. There is no lead export, and the agent cannot create or edit resources.
• Audience — audience_list_subscriptions and audience_get_fanflet_resources, limited to published fanflets whose subscriber email matches the signed-in account.
• Admin — platform-admin tools stay on the admin app's /api/mcp, not on fanflet.com. A platform admin connecting on fanflet.com does not get admin tools.

The token response currently always reports scope as admin. That label does not change which tools run. The profiles checked at sign-in do. A connection from before the chooser still follows the account role.

OAuth, for a client that is allowlisted