Bandruption MCP Connector

Bandruption hosts a Model Context Protocol (MCP) server at https://mcp.bandruption.fun/mcp. Adding it as a connector lets Claude — or any MCP-aware assistant — read your artist context and run admin operations on your behalf, with you in the loop for every change.

Status: OAuth 2.1 + PKCE is live on the production MCP endpoint. Keep this page synchronized with the currently deployed transport, scope, and tool surface.

Host migration: the former .com endpoint and OAuth audience are retired. Remove the old connector and re-register it with the .fun URL; old registrations and tokens are not accepted on the new audience.

What you can do with it

Once the connector is added and you've signed in, your assistant can:

• Read your data — fetch artist context (profile, loyalty program, counts), event lists, affiliate summaries, and bounty details.
• Run your fan-engagement programs — create, update, archive, and review claims on loyalty bounties for the artists or music-industry profiles you own.
• Set up events and ticketing — create draft events, add ticket types with pricing, capacity, and member-only options.
• Manage your storefront — create merch products with pricing, inventory, and variants.

Every write tool requires you to confirm the action in chat before it executes. Your assistant proposes the change first; you approve.

What you can't do (yet)

The MCP exposes admin operations only — the same actions you could perform in Bandruption's web admin. It does not:

• Transfer money, take card payments, or pay anyone out — the only spend is BANDS (Bandruption's in-app credit) from your own balance when you confirm social.publish_post, after a dry run that shows the cost
• Generate AI images or audio
• Access fan personal data outside your audit reach
• Modify other artists you don't own

Add the connector to Claude

Bandruption admits MCP clients by URL. Claude, Claude Code, and other MCP clients identify themselves with a Client ID Metadata Document (an https:// client ID hosted by the assistant's vendor); Bandruption's authorization server fetches, validates, and remembers that document. There is nothing to paste and there is no client secret. Clients that cannot present a metadata URL register automatically instead (RFC 7591). Either way the client is limited to the MCP server and the mcp:admin scope.

Claude.ai (web)

1. Open Settings → Connectors → Add custom connector.
2. Enter https://mcp.bandruption.fun/mcp as the URL. Leave Advanced settings empty.
3. Click Connect. You'll be redirected to Bandruption to sign in (or jump straight to consent if you signed in within the last 15 minutes; otherwise you sign in again). The consent page names the client Claude (claude.ai).
4. Review the requested access (admin scope on the artists you own) and click Approve.
5. The connector is now available in any chat. Try: "List my active bounties on <your-artist>."

A connector created earlier with the static client ID mcp_client_22199e09-0f81-4d37-bd57-84e48b36318f in Advanced settings keeps working; you can also remove it and add it again by URL alone.

Claude Code

Run:

claude mcp add --transport http bandruption https://mcp.bandruption.fun/mcp

then type /mcp inside Claude Code and choose Authenticate. Claude Code opens your browser and receives the code on a loopback redirect; the consent page names the client Claude Code (claude.ai).

Claude Desktop

1. Open Settings → Developer → Edit Config.
2. Add the Bandruption server to the mcpServers block:

   {
     "mcpServers": {
       "bandruption": {
         "url": "https://mcp.bandruption.fun/mcp"
       }
     }
   }
   

3. Restart Claude Desktop. The OAuth flow runs in your browser the first time you call a Bandruption tool; Claude Desktop presents its metadata URL, so no client ID is needed. Connectors added on claude.ai are also available in Claude Desktop when you are signed in to the same account.

Other MCP-aware clients

Any client that implements the MCP Authorization spec (OAuth 2.1 with PKCE) can connect. Clients that publish a Client ID Metadata Document are admitted by URL; clients that do not can register at the advertised registration_endpoint (RFC 7591) as a public client with PKCE. Registration is credential-free: send token_endpoint_auth_method as none (or private_key_jwt), because dynamically admitted clients are never issued a client secret. Loopback redirects (http://127.0.0.1:<port>/callback) and private-use schemes are recognised as native automatically, so bridges such as mcp-remote need no application_type; a private-use scheme must be a reverse-domain name with no naming authority (com.example.app:/callback, not com.example.app://callback). Both kinds are limited to the MCP server (resource=https://mcp.bandruption.fun/mcp) and the mcp:admin scope: they cannot request the platform API or machine-to-machine grants. A client that needs anything else still goes through a reviewed registration — ask support@bandruption.fun.

• Server URL: https://mcp.bandruption.fun/mcp
• Authorization Server discovery: the server returns WWW-Authenticate: Bearer resource_metadata="https://mcp.bandruption.fun/.well-known/oauth-protected-resource" on an unauthenticated request; that document names the authorization server https://auth.bandruption.fun, whose metadata lives at https://auth.bandruption.fun/.well-known/oauth-authorization-server
• Canonical OAuth resource: https://mcp.bandruption.fun/mcp
• Compatibility note: older clients that still send https://mcp.bandruption.fun are accepted during rollout, but Bandruption normalizes tokens to the canonical /mcp audience
• Required scope: mcp:admin, with resource=https://mcp.bandruption.fun/mcp

What the assistant sees

The server exposes:

Read tools

Tool	What it does
bounty.list	List bounties for an artist or industry entity, filtered by criterion type, reward type or active state
bounty.get	Fetch a single bounty by ID
artist.search	Find activated artists, unactivated Bandruption shells and Spotify candidates, with their platform status and usable identifiers
venue.search	Find a venue username to pass as event.create venue.industryName
social.connection_status	List the entity's connected social platforms and public handles; never returns tokens
asset.get_download	Verify a durable asset against the current payer and entity, then return a generation-bound download URL valid for ten minutes

Write tools

All write tools require explicit confirmed: true.

Tool	What it does
uploads.create_signed_url	Mint a Bandruption-managed upload URL for profile media and return the filePath you can reuse in entity.update_profile
entity.update_profile	Update an artist or music-industry profile, including avatar paths returned by uploads.create_signed_url
entity.update_tabs	Replace the order, enabled state and default selection of a profile tab configuration
event.create	Draft an in-person or virtual event
event.update	Preview or update event details, and replace the poster or ordered gallery using durable asset IDs
event.publish	Toggle an event between draft and live
event.attach_asset	Add a poster or gallery image to an event: begin an upload bound to the event, then verify and attach it (see below)
artist.resolve_event_guest	Preview or resolve an existing, Spotify or manual guest candidate to the username event.create and event.update accept
ticket_type.create	Add a ticket type to an event, with price, currency, capacity, sales window and member-only pricing
merch.create	Add a merch product to an artist's storefront, with price, inventory, variants and category
bounty.create	Create a fan-engagement bounty
bounty.update	Change an existing bounty (criteria and rewards may be replaced)
bounty.archive	Hide a bounty from fans and stop accepting claims
bounty.add_criterion	Append a criterion to a bounty
bounty.add_reward	Append a reward to a bounty
bounty.approve_claim	Approve a fan's bounty claim
bounty.reject_claim	Reject a fan's bounty claim
content.asset.create	Record platform-owned metadata for a generated content or campaign asset
social.compose_post	Compose a draft post for one of the entity's artifacts (bounty, event, merch, Top 10) on a connected platform
social.publish_post	Publish that post. This debits BANDS from your balance; the dry run shows the cost first

For entity-scoped MCP tool arguments, use lowercase public entityType values:

• artist
• music_industry

Older draft examples that showed uppercase enum constants (ARTIST, MUSIC_INDUSTRY) are not the public MCP contract.

Event posters and gallery images

Event images are part of the event, not free-standing uploads: the raw filePath from uploads.create_signed_url is not accepted by the event tools. Use event.attach_asset on an event you administer, in two phases:

1. event.attach_asset with eventId, role (POSTER or GALLERY) and upload: { fileName, contentType, byteSize, sha256 } (confirmed: true). The server mints a PENDING asset owned by you and bound to that event and returns assetId, uploadUrl, method: "PUT", requiredHeaders and expiresAt (15 minutes).
2. PUT the bytes to uploadUrl with exactly requiredHeaders.
3. event.attach_asset again with the same eventId and role plus the returned assetId (confirmed: true). The server verifies the uploaded object against the declared size and SHA-256, marks the asset READY and attaches it. Preview any step with confirmed: false; the attach preview reports objectUploaded so you can tell whether the PUT has landed.

Images are image/jpeg, image/png, image/webp or image/gif, up to 10 MiB. event.create.posterAssetId and event.update.posterAssetId accept READY asset IDs, so create the event first and add the poster through event.attach_asset.

Validation failures (a bad googleMapsUrl, a malformed venue.username, more than ten guests, …) come back as ok: false with error.statusCode: 400 and the field message; 500 means a server fault that is logged with the call's trace id.

Resources

Resource	Contents
bandruption://admin/artists/{username}/context	Full artist + loyalty-program snapshot
bandruption://admin/artists/{username}/events	Upcoming and past events
bandruption://admin/artists/{username}/affiliate-summary	Affiliate offering, links, and recent attributions

Rate limits and correlation

Bucket	Limit	Applies to
Per IP, unauthenticated	30 requests / 60 s	Discovery, metadata and any call without a bearer
Per IP, authenticated	600 requests / 60 s	Any call carrying a bearer token
Per credential	300 requests / 60 s	Each individual access token

Exceeding a bucket returns 429 with Retry-After. If the limiter's Redis is unavailable the server follows its configured fail mode; production fails closed, returning 503 with Retry-After: 60 rather than admitting unmetered traffic. It never returns a 500 for this.

Send x-bandruption-trace-id on any request to correlate it with Bandruption's logs when you report a problem. It must be at most 500 characters and match [A-Za-z0-9][A-Za-z0-9._:/-]*; anything else is rejected as a bad request. The value is echoed into the audit record for the call.

Security and privacy

• OAuth 2.1 + PKCE. Every connection runs through Bandruption's standard sign-in, and access tokens are short-lived (15 minutes) and refreshable until you revoke them.
• You're in control. Write tools never run without your explicit approval in chat. The server enforces a confirmed: true flag on every mutation.
• Scope is yours. The connector can only act on artists or music-industry profiles you own. It can't read or modify other accounts.
• Audit trail. Every tool call is logged to your Bandruption account's audit history. View it in the admin dashboard.
• Privacy. See the Bandruption Privacy Policy for details on how your data is handled.

Revoke access

Open Settings → Connectors → Bandruption → Disconnect in your assistant. The next refresh attempt will fail and the access token will expire within 15 minutes.

You can also revoke from Bandruption: Settings → Connected Apps, find the entry for your assistant, and click Revoke.

Support

• Bug reports / feature requests: support@bandruption.fun
• MCP spec: modelcontextprotocol.io