Blog / Onboard agents through MCP

Agent onboarding for SaaS: OAuth gets the agent in, it doesn't tell it what to do

Most “agent onboarding” advice stops at authentication. That part is now standard. The harder part is the first minute after: does the agent know what your product is for, where the user left off, and what to call first?

Leonid Bugaev · Published 21 Oct 2026

Getting in: standard MCP OAuth

The MCP spec covers this: MCP authorization. A compliance SaaS MCP server we studied does it by the book:

1. An unauthenticated request gets 401 with a WWW-Authenticate header pointing to the protected-resource metadata.
2. That names an authorization server with dynamic client registration, PKCE (S256) and refresh tokens.
3. The client registers itself, a browser opens, the user signs in, and the connection takes the user's role.

One detail worth copying: its 401 text is written for the agent, telling it to clear its tokens and reconnect, instead of a bare “unauthorized”.

After the login

The same server then sent 115,077 characters of instructions (26,633 tokens). Its most important rule, “call the status tool first on every connection”, sat at character 28,484.

To its credit, it repeats the rule in tool descriptions, which is how agents still found it. Lengths and cut-offs per app: server instructions length.

The first-call recipe

1. Instructions start with the rule: what the product is for, then “call get_instructions (or your status tool) first”. Under ~2,000 characters.
2. A start-here tool with a tiny schema that returns the user's state and one next step.
3. One line in other tools' descriptions: “Before your first call, call get_instructions once.”

Runs that called the start-here tool first, picked the right job and followed step 1. Details: make agents read your instructions first.

What stays on the web

• Sign-up, trial, card and purchases: in the web app. The server we studied kept them there.
• In MCP, say which tools spend money or contact people, and gate them: the two-step confirm pattern.
• Publish a docs page that lists the tools as the agent sees them, including what agents can't do.

Go deeper: When the agent doesn't recognise your server, Agent skills vs MCP server, Next-step hints.

Back to onboarding agents through MCP.

How we measured

• Example server: a public compliance SaaS MCP server, read through its public docs, its 401 response, and one connection's initialize, 2026; not named. Character positions counted on the instructions text; tokens by o200k_base.
• Recipe: mock server, Claude Code 2.1.302 and Codex, 232 runs on 18 Oct 2026, 95% Wilson ranges.
• Limits: one example server; OAuth details may change.