Lucky Code exposes scoped OAuth endpoints and a User MCP surface. Product tools are added only after the idea is approved.
User MCP
User MCP is available at /mcp with its own audience, scopes, client registrations and audit category.
OAuth
Clients must use PKCE, exact redirect validation, short-lived tokens and revocation. Browser sessions remain on the Lucky Code BFF with Secure HttpOnly cookies.
