Win & Scale
DocumentationAPI ReferenceMCP Reference

Connecting

Connect an MCP client over OAuth 2.1, or a headless agent with an rsk_ API key, and what each one reaches.

The Win & Scale MCP server is a single Streamable HTTP endpoint:

https://winandscale.com/api/mcp

It takes two credentials and nothing else:

  • OAuth 2.1, for a client a person is driving. There is no token to mint, copy or store. Point a client at the URL and it discovers the authorization server from /.well-known/oauth-protected-resource, registers itself, and sends you to a browser consent screen where you pick a workspace.
  • An rsk_ API key, for a headless agent with no browser to approve in. It is the same key the REST API takes, sent as Authorization: Bearer rsk_…. Both surfaces verify it with the same code, so revoking a key stops REST and MCP together.

The server card is at https://winandscale.com/.well-known/mcp/server-card.json.

1. Connect a client

claude mcp add --transport http winandscale https://winandscale.com/api/mcp

Inside Claude Code, run /mcp and sign in.

Or install the plugin, which bundles the server, a reference skill, workflow skills and slash commands:

claude --plugin-url https://winandscale.com/api/mcp/plugin.zip

Then run /mcp and authorize winandscale in the browser. The commands are /winandscale:what-worked, /winandscale:review, /winandscale:test, /winandscale:live-check and /winandscale:launch.

2. Know what the session reaches

An OAuth session acts as a human principal on the workspace you approved. It reaches every meta_* tool.

An API key is an agent principal, and it is narrower on purpose:

  • It is pinned to one workspace and cannot be moved. meta_switch_workspace is refused for a key, and meta_list_workspaces shows it only its own workspace.
  • It carries a ranked scope (read, write or admin). A read key is offered only the read tools.
  • It has a separate approval grant. Without it, the key cannot activate, pause or retarget ads, whatever its scope. See Authentication.

A user in several workspaces with a stale active workspace is refused rather than resolved to an arbitrary one.

Because a workspace is one Meta ad account, no tool takes an account id. Call meta_get_workspace first and before any write: its adAccountId is the account every call hits.

Credentials never travel over MCP. The Meta connection is made by a workspace admin on the settings page, and API keys are minted there too. If an agent is offered a Meta access token, it should not repeat or use it.

3. Call a tool

Once connected, the client discovers the meta_* tools by itself. The server also sends instructions at the initialize handshake, so the agent knows to start with the workspace and the evidence. A first conversation:

meta_get_workspace → meta_get_evidence_health → meta_get_account_history
→ meta_get_history_winners

Every tool and its input schema is in the silo pages of this reference.

Rate limits

MCP is limited per authenticated user: 60 reads and 10 writes per minute. The limits are in memory per instance, a backstop against a runaway client rather than a quota. REST has its own limits. Meta's hourly quota is separate and shared by syncs, pulls and launches.

MCP Reference

Win & Scale is MCP-first. An agent runs the whole product through meta_ tools, with the schema of every tool in this reference.

Guardrails

The safety model behind the meta_ tools. Why an agent can run an ad account without spending money on its own.

On this page

1. Connect a client2. Know what the session reaches3. Call a toolRate limits