Planned
View as Markdown

OpenClaw

ChatGPT is the live host today.

OpenClaw-class agent runtimes are a planned MCP host for POINTS. They are not QA-passed on production, and POINTS does not publish a date.

This page will carry the connection guide once the host passes QA on production. Until then, ChatGPT is the host to use; see the ChatGPT guide.

Host status comes from /docs/catalog.json. For how any MCP host discovers POINTS, see Discovery.

Draft setup (not yet QA-passed)

This draft is for QA on an approved test account only. It is not a live guide, and OpenClaw-class runtimes are not QA-passed on production.

Operator login (loopback callback)

openclaw mcp add points --url https://thepoints.io/mcp --transport streamable-http --auth oauth \
  --oauth-scope "balances:read transactions:read rewards:read optimize:read payments:draft payments:status identity:read module-status:read"
openclaw mcp login points
openclaw mcp doctor points --probe

Set transport to streamable-http; the OpenClaw default of sse is not supported here, and GET /mcp returns 405 with Allow: POST. openclaw mcp login registers itself, opens a browser sign-in to POINTS, and returns to a loopback callback on the port its local listener chose. You do not need a client id or secret. After the connection succeeds, openclaw mcp doctor points --probe should list the tools advertised in /docs/agents/reference/mcp-tools.json.

Per-requester Gateway callback

When a Gateway registers a public HTTPS origin, the per-requester callback is served on that origin, and the Gateway origin is registered automatically through Dynamic Client Registration. The callback must be an exact match: no trailing slash, query or fragment, and no http scheme for a non-loopback host.

Generic MCP clients

Any other OpenClaw-class runtime works the same way when it implements:

  • MCP Streamable HTTP POST requests. GET /mcp is 405, and no server-sent-events stream is served.
  • The Accept: application/json, text/event-stream header.
  • OAuth 2.1 public-client Dynamic Client Registration with PKCE S256.
  • RFC 8707 resource=https://thepoints.io/mcp on the authorize and token requests.
  • A loopback callback (127.0.0.1, [::1] or localhost, any port) or one exact registered HTTPS callback.

Disconnecting

openclaw mcp logout points only deletes the token stored on your computer; the grant stays active on POINTS until it expires. To end access, also revoke the app on Agent Connections in POINTS, after which calls return HTTP 401. Each app has its own revoke.