Connect an agent

Hosted MCP with OAuth, scoped Test/Live access and the same validated API contract.

Connect your agent

Add Castrook as a remote server in an OAuth-capable MCP client. Use Streamable HTTP and this endpoint:

https://castrook.com/mcp

Sign in and review the requesting app, callback destination, workspace and permissions. App names are unverified. Test starts selected unless the client explicitly requested a mode; read scopes are selected, write scopes are unchecked.

Approve the access you need

Remove permissions you do not need. Select write scopes only for the work you intend the app to perform. Live access lets the app act on real accounts. Each grant stays bound to its workspace, environment, resource and selected scopes.

usage:read is required for OAuth usage reads. API keys retain implicit access to their own usage. See the permission reference.

Start with a read

Ask the agent to list connected accounts and inspect usage. The server exposes typed tools, maintained resources and task prompts. Clients discover the actual schemas through tools/list; tools call the same validated API as REST. Discover Pinterest targeting with list_pinterest_boards and list_pinterest_board_sections, both requiring accounts:read.

Use Castrook in Test mode. List my accounts and remaining usage.
Report each account's profile, connection state and publishing capability.
Don't create a post yet.

Publish with a traceable result

When you authorize a post, the agent preserves a stable idempotency key, validates the selected destinations and follows delivery. A returned post ID means acceptance; every destination has its own final result.

OAuth access does not replace TikTok’s exact creator approval, current privacy choices or required preview. YouTube performance requires the account owner’s explicit current privacy acceptance. Public TikTok comment management is unavailable.

Build an OAuth client

Use authorization-server metadata and MCP resource metadata. Public clients use authorization-code + S256 PKCE with exact callbacks and state verification. HTTPS callbacks and exact HTTP loopback IP callbacks are supported.

REST clients use REST resource metadata. Tokens stay bound to the chosen resource; clients cannot reuse an MCP grant for a REST integration.

Manage connected agents

Open Developers → Agents to inspect mode, approved permissions, grant date and last use. Revoke access to invalidate that grant’s tokens. API keys are managed separately.

Access tokens expire and refresh tokens rotate. Reconnect after revocation or an expired grant; do not retry authorization errors as transient failures.

Read this guide as Markdown or use the machine manifest.