Connect an assistant (MCP)
The portal is the OAuth 2.1 authorization server. An MCP client that connects to either endpoint gets a 401 pointing at the protected-resource metadata, registers itself, sends you to this portal's own sign-in and consent pages, and comes back with a token scoped to that endpoint.
| Endpoint | Who | Scope |
|---|---|---|
https://64-227-176-64.sslip.io/mcp/citizen | An applicant acting for themselves | citizen |
https://64-227-176-64.sslip.io/mcp/officer | The Assistant Labour Officer | officer |
Claude Code
claude mcp add --transport http sande-citizen https://64-227-176-64.sslip.io/mcp/citizen claude mcp add --transport http sande-officer https://64-227-176-64.sslip.io/mcp/officer
Then in a session: /mcp → authenticate. Your browser opens this portal's sign-in; use the demo OTP.
MCP Inspector
npx @modelcontextprotocol/inspector
Transport: Streamable HTTP, URL https://64-227-176-64.sslip.io/mcp/citizen, then Open Auth Settings → Quick OAuth Flow.
Discovery
- /.well-known/oauth-protected-resource/mcp/citizen
- /.well-known/oauth-authorization-server
- /.well-known/jwks.json
- JSON API (what the MCP gateway calls)
How files and payments move
Tools never take a file or a card number. request_document_upload returns a one-time link to /ui/upload; create_payment returns a link to /ui/checkout. Clients that support URL-mode elicitation get the link as a consent prompt; terminal clients get it in the tool result. Either way the browser talks to the portal directly and the assistant then reads the result back.
Officer account for the demo
Mobile 9000000001, OTP 123456.