Nuclear News Network

MCP server · the nuclear buildout as a knowledge graph

Getting started

Authentication

Every request to the server is made as an NNN account. Clients prove that with an OAuth access token or an API key.

OAuth 2.1 (recommended)

Claude, ChatGPT, Grok, VS Code and other modern clients discover authentication on their own. You paste the URL, sign in to NNN and approve the client. Under the hood:

  1. The client calls /mcp without a token and gets 401 with a WWW-Authenticate header pointing at the protected-resource metadata.
  2. It reads https://mcp.nuclearnewsnetwork.com/.well-known/oauth-protected-resource/mcp (RFC 9728), which names the authorization server https://lztbptbvgrwwkvxwktuv.supabase.co/auth/v1.
  3. It registers itself (dynamic client registration) and starts an authorization-code flow with PKCE (S256).
  4. You sign in on this site and approve the request on the consent screen.
  5. The client receives an access token (one hour, refreshable) and sends it as Authorization: Bearer ….
discovery
curl -i https://mcp.nuclearnewsnetwork.com/mcp
# HTTP/1.1 401 Unauthorized
# WWW-Authenticate: Bearer resource_metadata="https://mcp.nuclearnewsnetwork.com/.well-known/oauth-protected-resource/mcp"

curl https://mcp.nuclearnewsnetwork.com/.well-known/oauth-protected-resource/mcp
# { "resource": "https://mcp.nuclearnewsnetwork.com/mcp", "authorization_servers": ["https://lztbptbvgrwwkvxwktuv.supabase.co/auth/v1"], ... }

Scopes are the standard OpenID ones (openid email profile). Access to tools is set by your plan, not by scopes.

API keys

For clients that take a fixed header, such as the xAI API, scripts and CI, create a key on your account page and send it as a bearer token:

header
Authorization: Bearer nnn_live_…
  • The key is shown once. NNN stores only its SHA-256 hash.
  • A key acts as you: same plan, same hourly limit, calls logged under your account.
  • Up to 10 active keys per account. Revoking takes effect immediately.

Revoking access

Your account page lists every OAuth client you approved and every API key. Disconnect a client or revoke a key at any time; the next request it makes gets 401.