feat(apps): add Glasser as a self-serve MCP connection

[glasserai]

Thinking Path

• Paperclip is the open source app people use to manage AI agents for work
• Agents that do research, prospecting and market work need data that lives behind paid APIs: person and company enrichment, people and company search, web and news search, SEO metrics, social media, property data
• Paperclip reaches external systems through governed, catalog-based MCP connections; the Apps catalog is data-driven, so a researched provider with a hosted remote MCP server becomes a connectable app with no runtime code change
• Glasser operates a hosted remote MCP server that exposes search, inspect and run over 1,000+ paid data endpoints behind one key, billed per call at each endpoint's published price
• The server supports OAuth 2.1 with dynamic client registration and an API key in a bearer header, the catalog's dcr_or_api_key shape
• This pull request adds Glasser to the self-serve MCP research ledger and generates its catalog entry with two connection methods: browser sign-in and API key
• The benefit is that an operator can give agents governed access to paid external data through the normal connection flow, with the key held in the instance vault and every call visible in Glasser's own run ledger

Linked Issues or Issue Description

Agent or provider
Glasser — a hosted remote MCP server over a catalog of paid third-party data endpoints (Apollo, People Data Labs, Hunter, Semrush, Ahrefs, DataForSEO, Serper, Exa, ScrapeCreators, RentCast and others) under one key.

Why this adapter is useful
Research, sales and marketing agents stop at "this data is not accessible" when the answer sits behind a paid API. With this connection an agent searches the endpoint catalog, inspects the exact contract and price, and runs the endpoint; Paperclip governs the connection and Glasser bills the call. No per-vendor keys, no scraper.

How the agent is invoked
Hosted remote MCP server (Streamable HTTP) at https://api.glasser.ai/mcp. Two access paths, verified against the live server on 2026-09-22:

• OAuth 2.1 browser sign-in. The server returns a WWW-Authenticate challenge with RFC 9728 protected-resource metadata; the authorization server publishes RFC 8414 metadata with a registration_endpoint, so Paperclip's automatic dynamic client registration applies. PKCE S256.
• API key. A Glasser Key (gl_ prefix) sent as Authorization: Bearer, created at https://app.glasser.ai/keys.

Official docs: https://glasser.ai/docs/mcp-server

Are you willing to implement it?
Yes. Implemented in this pull request. Disclosure: I work on Glasser.

Additional context
Research evidence collected 2026-09-22 from live protocol probes and the provider's own metadata endpoints:

• Unauthenticated POST https://api.glasser.ai/mcp returns HTTP 401 with WWW-Authenticate: Bearer realm="glasser", error="invalid_token", resource_metadata="https://api.glasser.ai/.well-known/oauth-protected-resource/mcp", scope="mcp".
• GET https://api.glasser.ai/.well-known/oauth-protected-resource/mcp → resource: https://api.glasser.ai/mcp, authorization_servers: ["https://app.glasser.ai/api/auth"], scopes_supported: ["mcp"], bearer_methods_supported: ["header"].
• GET https://app.glasser.ai/api/auth/.well-known/oauth-authorization-server → authorization_endpoint, token_endpoint, registration_endpoint (/oauth2/register), code_challenge_methods_supported: ["S256"], grant_types_supported: ["authorization_code", "client_credentials", "refresh_token"]. No registration was performed during the probe.
• With a Glasser Key as bearer, initialize answers server glasser (protocol 2025-06-18) and tools/list returns search, inspect, run, runs_get, runs_list, runs_stop, balance.

Risk tier S2: read-only business and public data (some endpoints return professional contact details); no money movement, deploys or external messaging. Each run is a paid call at a published price; the method guidance says so.

What Changed

• packages/shared/src/self-serve-mcp-research.json: add the Glasser ledger entry (dcr_or_api_key, S2, wave 4, docs and server URLs)
• scripts/ingest-app-definitions.mjs: category data; API key placement Authorization: Bearer with a gl_ placeholder
• packages/shared/src/app-definitions/glasser.json and app-definitions.generated.ts: generated by node scripts/ingest-app-definitions.mjs --definitions-only; methods mcp-oauth (DCR) and mcp-api-key
• ui/public/brands/apps/glasser.svg, glasser-dark.svg, manifest.json: the official Glasser mark from the provider's brand kit (black head / orange strap on light, orange head / black strap on dark), catalogVisible: true
• packages/shared/src/app-definitions.test.ts: ledger and store counts, plus a Glasser methods assertion
• server/src/__tests__/tool-access-service.test.ts: catalog count and slug list

Verification

node scripts/ingest-app-definitions.mjs --definitions-only          # emitted 75 definitions; diff touches only glasser
node scripts/check-app-brand-assets.mjs                              # Validated 74 brand identities
node --test scripts/app-brand-validation.test.mjs                    # pass
pnpm exec vitest run packages/shared/src/app-definitions.test.ts ui/src/lib/app-brand-assets.test.ts ui/src/pages/apps/AppLogo.brand-assets.test.tsx   # 3 files, 39 tests passed

Live proof: the four probes listed under Additional context, run on 2026-09-22 against api.glasser.ai. Outstanding: the tool-access-service server test needs embedded Postgres and was not run locally; CI runs it. A full connect → grant → execute → revoke pass through the Paperclip UI was not run in this PR.

Risks

• Low risk. Catalog data and brand assets only; no runtime code.
• The connection is opt-in and holds the key in the instance vault; agents never see it.
• Glasser bills per call. The method guidance and warnings state this so an operator is not surprised.
• Rollback: remove the ledger entry and regenerate; the definition and assets go with it.

Model Used

• Claude (Anthropic), model claude-fable-5-1, extended thinking, tool use, via Claude Code; a human reviewed every file and ran the live probes.

Checklist

• I have included a thinking path that traces from project context to this change
• I have specified the model used (with version and capability details)
• I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work
• I have searched GitHub for duplicate or related PRs and linked them above
• I have either (a) linked existing issues with Fixes: # / Closes # / Refs # OR (b) described the issue in-PR following the relevant issue template
• I have not referenced internal/instance-local Paperclip issues or links (only public GitHub #NNN / github.com/paperclipai/paperclip URLs)
• My branch name describes the change (e.g. docs/..., fix/...) and contains no internal Paperclip ticket id or instance-derived details
• I have run tests locally and they pass
• I have added or updated tests where applicable
• I have updated relevant documentation to reflect my changes
• I have considered and documented any risks above
• All Paperclip CI gates are green
• Greptile is 5/5 with no open P2s, recommendations, or follow-ups
• I will address all Greptile and reviewer comments before requesting merge

[greptile-apps]

Confidence Score: 4/5

The code changes appear internally consistent, but the explicit connector-playbook requirement for account-bound lifecycle validation must be completed before merge.

Findings

1.  Required lifecycle proof is missing ▶

Fix with agent prompt

### Issue 1
packages/shared/src/app-definitions/glasser.json:20-25
This store-visible connector exposes both OAuth and API-key methods, but the PR states that the Paperclip connect-to-revoke flow was not run. The repository's connector playbook requires account-bound connect, catalog, safe-call, refresh or reconnect, revoke, and secret-inspection validation for every exposed method. Complete that validation for both methods before merging.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

Adds Glasser as a self-serve, store-visible MCP connection for governed access to paid data providers.

• Adds OAuth dynamic-client-registration and bearer API-key connection methods.
• Registers Glasser in the research ledger, generated catalog, app-store tests, and server catalog expectations.
• Adds light and dark Glasser brand assets and their manifest entries.
• The latest changes add the required mcp OAuth scope and direct users to Glasser’s key-management page.

_{Reviews (2) · Last reviewed commit: "feat(apps): send the mcp scope on Glasse..."}

[greptile-apps]

Required lifecycle proof is missing

This store-visible connector exposes both OAuth and API-key methods, but the PR states that the Paperclip connect-to-revoke flow was not run. The repository's connector playbook requires account-bound connect, catalog, safe-call, refresh or reconnect, revoke, and secret-inspection validation for every exposed method. Complete that validation for both methods before merging.

Context Used: AGENTS.md (source)

Prompt To Fix With AI

This is a comment left during a code review.
Path: packages/shared/src/app-definitions/glasser.json
Line: 20-25

Comment:
**Required lifecycle proof is missing**

This store-visible connector exposes both OAuth and API-key methods, but the PR states that the Paperclip connect-to-revoke flow was not run. The repository's connector playbook requires account-bound connect, catalog, safe-call, refresh or reconnect, revoke, and secret-inspection validation for every exposed method. Complete that validation for both methods before merging.

**Context Used:** AGENTS.md ([source](https://github.com/paperclipai/paperclip/blob/master/AGENTS.md))

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.