# Operator Stack — full agent map

> The expanded companion to https://operator.promptmetrics.dev/llms.txt: every scope, every tool, the whole
> authorization flow and the error semantics, for an agent deciding how to integrate
> with the Operator Stack community. Run by PromptMetrics, Berlin.

This file is the map, not the corpus. For content, call search_posts over MCP — it
applies the same visibility rules as the site and stays current. Do not expect a
dump of posts here; the sitemap lists every public URL if you need to enumerate.

## Connecting

- [MCP endpoint](https://operator.promptmetrics.dev/api/mcp): Streamable HTTP, POST only, revision 2026-07-28. GET and DELETE answer 405.
- [Step 1 — protected resource metadata](https://operator.promptmetrics.dev/.well-known/oauth-protected-resource/api/mcp): names the authorization server
- [Step 2 — authorization server metadata](https://operator.promptmetrics.dev/.well-known/oauth-authorization-server): names the endpoints and scopes
- [Step 3 — register](https://operator.promptmetrics.dev/api/oauth/register): RFC 7591, open, returns a client_id
- [Step 4 — authorize](https://operator.promptmetrics.dev/oauth/authorize): browser consent, PKCE S256 required
- [Step 5 — token](https://operator.promptmetrics.dev/api/oauth/token): authorization_code, then refresh_token
- [Revoke](https://operator.promptmetrics.dev/api/oauth/revoke): RFC 7009

Access tokens live one hour. Refresh tokens live thirty days, rotate on every use,
and replaying a rotated refresh token invalidates the whole chain.

## Scopes and tools

- [Scope reference](https://operator.promptmetrics.dev/docs): the same table, rendered

### community:read

Read community posts, profiles, and leaderboards.

Enforcement: Enforced at the transport: verifyMcpOAuthToken rejects any token without it. No bound user required.

Tools (4): search_posts, get_user_profile, list_leaderboards, summarize_thread

### community:write

Create posts and comments, react, follow, and join circles.

Enforcement: Enforced per tool by requireScope plus requireUserId — the token must be bound to a community member.

Tools (13): create_post, update_post, delete_post, create_comment, update_comment, delete_comment, accept_solution, toggle_reaction, toggle_bookmark, follow_user, unfollow_user, join_circle, leave_circle

### community:admin

Admin: manage users, groups, badges, and moderation.

Enforcement: Granted only when the bound user is an admin at authorize, approve AND token time, then re-checked against the database on every call. Every use is written to the audit log.

Tools (21): admin_list_users, admin_get_user, admin_set_user_role, admin_delete_user, admin_list_groups, admin_create_group, admin_update_group, admin_delete_group, admin_update_settings, admin_award_points, admin_list_badges, admin_create_badge, admin_award_badge, admin_list_watched_phrases, admin_create_watched_phrase, admin_delete_watched_phrase, admin_resolve_flag, admin_delete_flag, admin_list_audit_logs, admin_list_mcp_clients, admin_revoke_mcp_client

## Resources

- [community://users/{slug}](https://operator.promptmetrics.dev/api/mcp): JSON resource template
- [community://groups/{slug}](https://operator.promptmetrics.dev/api/mcp): JSON resource template
- [community://posts/{id}](https://operator.promptmetrics.dev/api/mcp): JSON resource template
- [community://leaderboards/{type}](https://operator.promptmetrics.dev/api/mcp): JSON resource template

## Limits and errors

- [Rate limits](https://operator.promptmetrics.dev/docs): 100/min per client at the transport, 30/min across write tools, 20/min across admin tools
- [401](https://operator.promptmetrics.dev/.well-known/oauth-protected-resource/api/mcp): missing or invalid token; the WWW-Authenticate header names the metadata document to read
- [403](https://operator.promptmetrics.dev/docs): the token is valid but lacks the scope the tool needs
- [429](https://operator.promptmetrics.dev/docs): rate limited; Retry-After says how long to wait
- [404](https://operator.promptmetrics.dev/docs): the MCP server is switched off in this environment

## Reading the site directly

- [Feed](https://operator.promptmetrics.dev/api/v1/feed): recent public posts across every circle, JSON, no auth
- [Circles](https://operator.promptmetrics.dev/api/v1/groups): every public circle
- [One circle](https://operator.promptmetrics.dev/api/v1/groups/where-do-i-start): a circle by slug
- [A profile](https://operator.promptmetrics.dev/api/v1/users/izzy-a): public member profile, reputation and badges
- [Leaderboards](https://operator.promptmetrics.dev/api/v1/leaderboards): reputation rankings
- [Search](https://operator.promptmetrics.dev/api/v1/search?q=hubspot): full-text over public posts
- [OpenAPI](https://operator.promptmetrics.dev/openapi.json): typed response schemas for all six, plus the error model
- [Markdown negotiation](https://operator.promptmetrics.dev/feed): send Accept: text/markdown to any public page
- [Sample thread, no credentials](https://operator.promptmetrics.dev/api/demo/thread): the summarize_thread shape
- [Sitemap](https://operator.promptmetrics.dev/sitemap.xml): every public URL
- [OpenAPI 3.1](https://operator.promptmetrics.dev/openapi.json): this surface, machine-readable