FanFuzer

FanFuzer's MCP server is a remote, stateless server using the Streamable HTTP transport, at https://mcp.fanfuzer.com/mcp. It runs as a Supabase Edge Function behind our own domain. ▎ Authentication: OAuth 2.1 with dynamic client registration, provided by Supabase Auth's OAuth server. The server publishes protected resource metadata (RFC 9728) and answers unauthenticated requests with a 401 and a WWW-Authenticate challenge. Users sign in on FanFuzer's own page and approve access on a consent screen that lists what the connector can and cannot do. Only the email and profile scopes are requested. Authorization: every tool call runs with the signed-in user's own access token, so FanFuzer's database row-level security applies exactly as it does in our app. The connector can reach only the artist or venue account the user signed in with. Fan accounts receive a clear error. Tools (6), each with a title and safety annotations: - list_my_events, get_event, get_analytics, get_audience: read only (readOnlyHint). - create_event, update_event: write, not destructive (destructiveHint false). Write limits: create_event makes paid events as drafts only. update_event edits drafts only. Nothing can be published, cancelled or deleted through the connector. Draft events are private to their owner at the database level. Free events are refused, because they use an allowance that is enforced in the FanFuzer app. Data minimisation: no fan personal data is returned. Audience data is totals only. There is no access to payments, payouts, refunds or Stripe.