# Telemio agent instructions — MCP OAuth and PKCE

Set up a Telemio remote MCP connection using https://mcp.telemio.sh/mcp. Prefer OAuth authorization code with PKCE S256. Discover metadata from /.well-known/oauth-protected-resource and /.well-known/oauth-authorization-server; do not invent OAuth endpoints or callback URLs. Use client-specific redirects registered with the provider. Request read scope for read operations, write scope only when necessary, and enforce workspace permissions. Never ask the user to paste OAuth tokens, MCP secrets, or server ingest keys. Verify the connection through real MCP tool calls.

Reference: https://telemio.sh/docs/authentication/mcp-oauth.html