Connect an MCP client to /mcp. OAuth opens a browser where each
user signs in to their own 360Player account. The password is never stored; the
resulting upstream session is encrypted at rest.
Read and guarded communication tools are available. Every write requires the write scope, upstream permission, and an explicit confirmation argument.