On Call MCP Server
A demo MCP server that acts as an OAuth resource server. You point it at your own authorization server — an Okta custom AS or an Auth0 tenant — and it uses the scopes and roles in the tokens that server issues to decide which tools a caller may use.
Use it to test an MCP client that does OAuth, including step-up authorization: two of the four tools require scopes a client will typically not have on its first token. This server never issues tokens of its own. It only verifies them.
Get started
Create a sandbox to get your own endpoint and connect your own authorization server. No username, no password — a recovery URL or a passkey gets you back in.
Tools
All 4 tools are always listed, whatever the token contains. The authorization check happens when a tool is called, so a client can see the full capability set and knows which scope to ask for.
| Tool | What it does | Requires |
|---|---|---|
who_is_on_call |
Find out who is currently on call, and see recent on-call handoffs. | Nothing |
set_myself_on_call |
Put yourself on call, taking over from whoever is currently on call. | The oncall role in the roles claim |
page_on_call |
Send a page to whoever is currently on call. | The page scope |
declare_incident |
Declare a new incident and assign it an incident number. | The incident scope |
A denied call comes back as a normal MCP tool error naming the missing scope or role, so a client knows what to ask for next. The role and claim names are per account.