Bird's server does not store secrets and does not do its own validation — each request carries your OAuth token and the Bird API checks it per call. That means the MCP layer is stateless and, from a security standpoint, uninteresting: compromising it gains an attacker nothing they could not get from the public internet. Pricing follows the same instinct — usage-based, no seats, no platform fee, no annual lock on features.
Bird's hosted endpoint (the catalogue row still carries the SparkPost name from their email product). The tool list is deliberately not a public address: Bird states that the live list a client pulls, and the OpenAPI behind it, are the authoritative reference.
Whatever the live handshake returns for your account. Bird says this in two places — llms.txt and the MCP server documentation — rather than publishing a count that would go stale.
An OAuth 2.1 bearer token. The tools are listable without one, but every call returns 401 until the token is present.
Paste a URL, then authorize — add the endpoint to your client, then approve the OAuth consent screen