Developer connectors — Scarlet Sync Support

Scarlet Sync exposes public discovery endpoints plus authenticated planning APIs for agents and integrations.

Primary entry points

https://scarletsync.app/openapi.json - OpenAPI JSON for the authenticated ChatGPT connector
https://scarletsync.app/api/mcp - MCP endpoint for Claude and other MCP clients
compatible browser agents can also discover three read-only WebMCP tools from Scarlet Sync pages through document.modelContext: allowlisted page-family context, connector discovery, and public Rutgers knowledge search
https://scarletsync.app/.well-known/oauth-authorization-server - OAuth authorization-server metadata
https://scarletsync.app/.well-known/oauth-protected-resource - OAuth protected-resource metadata
https://scarletsync.app/llms.txt - machine-readable product and integration summary
https://scarletsync.app/developers - developer landing page with setup details

Supported auth scopes

courses:read
schedules:read
degree:read

High-level capability areas

Course search, section detail, and open-section checks
Schedule generation plus saved schedule CRUD
Degree search, requirement inspection, and saved degree-plan CRUD
Semester-level degree-plan edits
Profile, completed-course, and course-list context
Campus utilities including events, buses, parking, dining, room availability, and SIRS

Suggested setup flow

Start with llms.txt or /developers to discover the product surface.
Use the OAuth well-known metadata to configure client auth.
Read openapi.json for REST integrations.
Use /api/mcp for MCP-native clients.
In a WebMCP-capable browser, open Scarlet Sync normally; the page registers its bounded read-only tools automatically. Unsupported browsers continue without a polyfill or behavior change.

During Chrome's experimental period, local use requires the WebMCP testing flag and ordinary deployed use requires a valid Origin Trial enrollment/token. Source support alone does not activate the API for every visitor. WebMCP tools do not inherit the signed-in account, expose dynamic or attacker-controlled path or query-string state, send a Referer with public-search requests, or perform writes. Unknown routes return a fixed context fallback, and public-search output has an 8,000-character aggregate serialized budget.

For an enrolled deployment, set the public origin-bound WEBMCP_ORIGIN_TRIAL_TOKEN environment value. next.config.ts emits it as the Origin-Trial response header only when configured; leaving it unset preserves the normal capability-detected fallback.

Notes

Public capability probes and some campus summaries can be read without a user session.
User-specific schedule, degree-plan, profile, memory, course-list, and feedback actions require OAuth tokens.
Scarlet Sync is optimized around Rutgers New Brunswick academic planning and campus context.