Connectors

This connects external software to Chance’s hosted MCP server. To choose the AI powering a Desk, use Desk AI sign-in instead. A provider account connection and a Chance MCP connection are separate. The hosted MCP server is at:

https://harness.chance.cc/api/mcp

Every client reaches the same tools here. The local package chance-mcp forwards to this endpoint.

Endpoint

Streamable HTTP, stateless, with buffered JSON responses. Only POST is accepted; GET and DELETE return 405.
A request can run for up to 300 seconds.
A missing or invalid credential returns 401 with a JSON-RPC error (-32001) and the header WWW-Authenticate: Bearer resource_metadata="https://harness.chance.cc/.well-known/oauth-protected-resource", which OAuth clients follow to start sign-in.

Credentials

Credential	How it is sent	Used by	Scopes
OAuth access token	The client obtains it after you approve the Chance consent screen	Claude (web, desktop and mobile), ChatGPT, Claude Code, Cursor	The scopes the client requested and you approved
API key (`chance_sk_live_…`)	`Authorization: Bearer <key>` or `x-api-key: <key>`	Anthropic Messages API, OpenAI Responses API, `mcp-remote`, `chance-mcp`	`mcp` and `wallet`

Create API keys at harness.chance.cc/keys.

Scopes

Scope	Access
`mcp`	Verification requests, connection checks and balance top-ups.
`wallet`	Wallet balances, transaction proposals, swaps and private-action tools.

OAuth grants only the scopes requested and approved. An API key carries both scopes. A client that requests no scope gets mcp. The available tools depend on server configuration. Use tools/list for current names and schemas, and MCP tools for the tool groups. A wallet tool may be listed but require reconnecting with wallet access before it can run.

Connect a client

In an MCP client that supports remote servers, add a server named Chance with this URL:

https://harness.chance.cc/api/mcp

Choose OAuth, sign in to Chance and review the requested access. The server supports dynamic client registration; you do not need a pre-issued client ID or secret. For clients that only launch local stdio servers, use the local MCP package. For a custom API client, send the Chance API key as a bearer credential when connecting to the server:

Authorization: Bearer <CHANCE_API_KEY>

Keep the key on your server or in the client’s secret storage. It identifies the Chance account whose tools and balance the connection uses.

Confirm the connection

Call check_connection once. It is free.

{
  "ok": true,
  "account": "you@example.com",
  "creditsRemaining": 50,
  "balanceUsd": 2.5,
  "escrowTools": true,
  "authMethod": "oauth"
}

account is the account’s email, or its wallet address or account id when it has no email. authMethod is oauth or api_key. Use balanceUsd for the account balance. creditsRemaining is the number of verification checks that balance covers. Do not use verify_intent as a connection test: it is a paid check.

Disconnect a client

Open Settings on the Chance dashboard. Apps and computers lists every client signed in to your account, with what each one can do. Select Sign out next to one to end its access. Its tokens stop working immediately.

OAuth reference

Item	Value
Protected resource metadata	`GET /.well-known/oauth-protected-resource` (also served at `/.well-known/oauth-protected-resource/api/mcp`)
Authorization server metadata	`GET /.well-known/oauth-authorization-server`
Dynamic client registration	`POST /api/oauth/register` with `redirect_uris` and an optional `client_name`. Returns `201`.
Authorization endpoint	`/oauth/authorize`, the consent screen. You sign in with your Chance account.
Token endpoint	`POST /api/oauth/token`. Grant types `authorization_code` and `refresh_token`.
PKCE	`S256` only. `plain` is rejected.
Client authentication	None. Clients are public (`token_endpoint_auth_method: none`).
Redirect URI	`https`, or `http` on `localhost` or `127.0.0.1`. At most 10 per client. The URI in an authorization request must exactly match one the client registered.
Authorization code	Single use, valid for 5 minutes.
Access token	Valid for 1 hour.
Refresh token	Valid for 30 days. Each refresh returns a new refresh token and revokes the old one. Presenting a revoked refresh token revokes every live token from the same sign-in (the tokens issued from one authorization code and its refreshes).
Resource	Optional (RFC 8707). A token request naming a different Chance resource than the sign-in did is refused with `invalid_target`.
Scopes	`mcp` (default) and `wallet`

All endpoints are on https://harness.chance.cc. Paid requests charge the Chance account that approved the connection.

Integrate

Chance verification

Payload adapters

HTTP endpoints

Endpoint

Credentials

Scopes

Connect a client

Confirm the connection

Disconnect a client

OAuth reference

​Endpoint

​Credentials

​Scopes

​Connect a client

​Confirm the connection

​Disconnect a client

​OAuth reference

Endpoint

Credentials

Scopes

Connect a client

Confirm the connection

Disconnect a client

OAuth reference