Back to support

Reviewed guide

Developer connectors

How external integrations connect to Scarlet Sync and where the OAuth boundary applies.

Checked-in snapshotSource: Maintained Scarlet Sync reference

Developer Connectors

Scarlet Sync exposes public discovery endpoints plus authenticated planning APIs for agents and integrations.

Primary entry points

  • https://scarletsync.app/openapi.json - OpenAPI JSON for the authenticated ChatGPT connector
  • https://scarletsync.app/api/mcp - MCP endpoint for Claude and other MCP clients
  • compatible browser agents can also discover three read-only WebMCP tools from Scarlet Sync pages through document.modelContext: allowlisted page-family context, connector discovery, and public Rutgers knowledge search
  • https://scarletsync.app/.well-known/oauth-authorization-server - OAuth authorization-server metadata
  • https://scarletsync.app/.well-known/oauth-protected-resource - OAuth protected-resource metadata
  • https://scarletsync.app/llms.txt - machine-readable product and integration summary
  • https://scarletsync.app/developers - developer landing page with setup details

Supported auth scopes

  • courses:read
  • schedules:read
  • degree:read

High-level capability areas

  • Course search, section detail, and open-section checks
  • Schedule generation plus saved schedule CRUD
  • Degree search, requirement inspection, and saved degree-plan CRUD
  • Semester-level degree-plan edits
  • Profile, completed-course, and course-list context
  • Campus utilities including events, buses, parking, dining, room availability, and SIRS

Suggested setup flow

  1. Start with llms.txt or /developers to discover the product surface.
  2. Use the OAuth well-known metadata to configure client auth.
  3. Read openapi.json for REST integrations.
  4. Use /api/mcp for MCP-native clients.
  5. In a WebMCP-capable browser, open Scarlet Sync normally; the page registers its bounded read-only tools automatically. Unsupported browsers continue without a polyfill or behavior change.

During Chrome's experimental period, local use requires the WebMCP testing flag and ordinary deployed use requires a valid Origin Trial enrollment/token. Source support alone does not activate the API for every visitor. WebMCP tools do not inherit the signed-in account, expose dynamic or attacker-controlled path or query-string state, send a Referer with public-search requests, or perform writes. Unknown routes return a fixed context fallback, and public-search output has an 8,000-character aggregate serialized budget.

For an enrolled deployment, set the public origin-bound WEBMCP_ORIGIN_TRIAL_TOKEN environment value. next.config.ts emits it as the Origin-Trial response header only when configured; leaving it unset preserves the normal capability-detected fallback.

Notes

  • Public capability probes and some campus summaries can be read without a user session.
  • User-specific schedule, degree-plan, profile, memory, course-list, and feedback actions require OAuth tokens.
  • Scarlet Sync is optimized around Rutgers New Brunswick academic planning and campus context.