Most servers advertise one protected resource for the whole endpoint. Deckflow publishes metadata per path, which means a token can be scoped to the conversion capability without also covering everything else the platform does. That is the protocol working as designed, and it is worth knowing if you are building a client — you authorise against the path you intend to call, not the host.
Deckflow's endpoint, split by capability: html2pptx, pptx and tools each have their own path, with a compatibility endpoint alongside. Each path advertises its own protected-resource metadata.
12 tools by the vendor's documentation, centred on generating PowerPoint from HTML. The endpoints return 401 without credentials, so we could not list them.
OAuth with PKCE and dynamic client registration against mcp.deckflow.com, scope deckflow. Each capability path carries its own resource metadata, so a client authorises for the capability it needs.
Paste a URL, then authorize — add the endpoint to your client, then approve the OAuth consent screen