Session 1c1ae993
Provider: Claude • Model: claude-sonnet-5-5 • Category: delegated-access • Score: 96.3 (Excellent)
Rubric evidence
The agent reached the API docs at /support/docs/api and read the page text. It reported OAuth 2.1 with scoped tokens and listed three scopes (mcp:read, mcp:write, mcp:run) with descriptions. The transcript truncates the page text, so I can't fully check the details, but the answer is specific and plausible.
- 2026-10-04T21:45:26.335407+00:00 · tool_call · navigate
{ "step": { "ts": "2026-10-04T21:45:26.119Z", "kind": "tool_call", "name": "navigate", "input": { "url": "https://www.stuntdouble.io" } }, "stepIndex": 0 } - 2026-10-04T21:45:28.045142+00:00 · tool_result · navigate
{ "step": { "ts": "2026-10-04T21:45:27.833Z", "kind": "tool_result", "name": "navigate", "text": "Navigated to https://www.stuntdouble.io/\nNow on https://www.stuntdouble.io/ (Stunt Double: product testing and user research by AI users)" }, "stepIndex": 1 } - 2026-10-04T21:45:30.490558+00:00 · screenshot
{ "stepIndex": 1 }
- 2026-10-04T21:45:30.922383+00:00 · tool_call · find
{ "step": { "ts": "2026-10-04T21:45:29.247Z", "kind": "tool_call", "name": "find", "input": { "query": "API / docs links" } }, "stepIndex": 2 } - 2026-10-04T21:45:31.275404+00:00 · tool_result · find
{ "step": { "ts": "2026-10-04T21:45:29.270Z", "kind": "tool_result", "name": "find", "text": "No elements match \"API / docs links\"." }, "stepIndex": 3 } - 2026-10-04T21:45:31.675703+00:00 · tool_call · click
{ "step": { "ts": "2026-10-04T21:45:30.430Z", "kind": "tool_call", "name": "click", "input": { "x": 640, "y": 28 } }, "stepIndex": 4 } - 2026-10-04T21:45:32.774155+00:00 · tool_result · click
{ "step": { "ts": "2026-10-04T21:45:31.933Z", "kind": "tool_result", "name": "click", "text": "left click on (640, 28)\nNow on https://www.stuntdouble.io/ (Stunt Double: product testing and user research by AI users)" }, "stepIndex": 5 } - 2026-10-04T21:45:34.62989+00:00 · screenshot
{ "stepIndex": 5 }
- 2026-10-04T21:45:35.031367+00:00 · tool_call · click
{ "step": { "ts": "2026-10-04T21:45:33.371Z", "kind": "tool_call", "name": "click", "input": { "x": 453, "y": 116 } }, "stepIndex": 6 } - 2026-10-04T21:45:35.637115+00:00 · tool_result · click
{ "step": { "ts": "2026-10-04T21:45:35.341Z", "kind": "tool_result", "name": "click", "text": "left click on (453, 116)\nNow on https://www.stuntdouble.io/ (Stunt Double: product testing and user research by AI users)" }, "stepIndex": 7 } - 2026-10-04T21:45:36.781277+00:00 · screenshot
{ "stepIndex": 7 }
- 2026-10-04T21:45:37.140703+00:00 · tool_call · screenshot
{ "step": { "ts": "2026-10-04T21:45:36.498Z", "kind": "tool_call", "name": "screenshot", "input": {} }, "stepIndex": 8 } - 2026-10-04T21:45:37.505175+00:00 · tool_result · screenshot
{ "step": { "ts": "2026-10-04T21:45:36.624Z", "kind": "tool_result", "name": "screenshot", "text": "Screenshot of https://www.stuntdouble.io/support/docs" }, "stepIndex": 9 } - 2026-10-04T21:45:38.58028+00:00 · screenshot
{ "stepIndex": 9 }
- 2026-10-04T21:45:38.925997+00:00 · tool_call · find
{ "step": { "ts": "2026-10-04T21:45:38.047Z", "kind": "tool_call", "name": "find", "input": { "query": "API reference / authentication sidebar links" } }, "stepIndex": 10 } - 2026-10-04T21:45:39.285146+00:00 · tool_result · find
{ "step": { "ts": "2026-10-04T21:45:38.066Z", "kind": "tool_result", "name": "find", "text": "link \"API overview\" href=\"/support/docs/api\" [ref_1]\nlink \"API overview Automate Stunt Double from your own tools, or from Claude, over MCP.\" href=\"/support/docs/api\" [ref_2]" }, "stepIndex": 11 } - 2026-10-04T21:45:39.716367+00:00 · tool_call · navigate
{ "step": { "ts": "2026-10-04T21:45:39.507Z", "kind": "tool_call", "name": "navigate", "input": { "url": "https://www.stuntdouble.io/support/docs/api" } }, "stepIndex": 12 } - 2026-10-04T21:45:41.347562+00:00 · tool_result · navigate
{ "step": { "ts": "2026-10-04T21:45:41.127Z", "kind": "tool_result", "name": "navigate", "text": "Navigated to https://www.stuntdouble.io/support/docs/api\nNow on https://www.stuntdouble.io/support/docs/api (API documentation | Stunt Double)" }, "stepIndex": 13 } - 2026-10-04T21:45:43.217746+00:00 · screenshot
{ "stepIndex": 13 }
- 2026-10-04T21:45:43.592395+00:00 · tool_call · get_page_text
{ "step": { "ts": "2026-10-04T21:45:41.127Z", "kind": "tool_call", "name": "get_page_text", "input": {} }, "stepIndex": 14 } - 2026-10-04T21:45:43.948208+00:00 · tool_result · get_page_text
{ "step": { "ts": "2026-10-04T21:45:41.228Z", "kind": "tool_result", "name": "get_page_text", "text": "Support GETTING STARTED Introduction Quickstart CONCEPTS Core concepts TUTORIALS Overview Build an actor that behaves like your audience Write checklists that catch real regressions Run a user interview Automate multi-step workflows Turn runs into insights Collect stakeholder feedback on a prototype Review designs from Slack Test a product behind your firewall Automate Stunt Double from Claude OPEN SOURCE Stuntkit Give an AI agent a safe browser GUIDES Integration guides API API overview MCP server Stunt Double API Stunt Double exposes its platform programmatically through a Model Context Protocol (MCP) server. MCP is an open standard for connecting AI clients to tools and data, which means you can drive your workspace from Claude, from your own agents, or from any MCP-compatible client, without writing a bespoke integration. The MCP server The server is hosted by the product app at: https://app.stuntdouble.io/api/mcp It speaks the Streamable HTTP transport. Point any MCP client at that URL to list and call the available tools. For a full walkthrough, including client configuration, see the MCP server page. What you can manage The server groups its tools by the resource they act on: Resource What you can do Workspaces List workspaces and members, read workspace details Actors List, read, create, and update actors Knowledge List, add, and remove an actor's knowledge Conversations List and read conversations Checklists List, read, run checklists, and read checklist runs Workflows List, read, run workflows, and read workflow runs Feedback List and read feedback, and update its status Interviews Create, read, update, launch interviews, and read interview reports Authentication Access is authorised with OAuth 2.1. MCP clients that support OAuth will discover the authorisation and token endpoints automatically and prompt you to sign in to your Stunt Double workspace the first time you connect. Tokens are scoped, so a client can ask for only the access it needs: Scope What it allows mcp:read Read workspaces and their contents: projects, actors, checklists, interviews, workflows and results mcp:write Create and edit projects, actors, knowledge, guidelines, checklists, interviews and workflows mcp:run Start checklist runs, workflow runs and interviews, which use the workspace run allowance A client that requests no scope is granted all three. A token only lists the tools its scopes cover, and every tool also checks that you are a member of the workspace it was asked about. The authorisation server publishes its RFC 8414 metadata, including scopes_supported. Versioning and deprecation The MCP server is versioned by the protocol itself: a client negotiates a version at initialize and sends it on every later request in the MCP-Protocol-Version header. The public HTTP endpoints follow semantic versioning (info.version in the OpenAPI spec). A breaking change ships under a new path or header value alongside the old one, never in place. When something is deprecated, it is marked deprecated: true in the OpenAPI spec, its responses carry a Deprecation header (RFC 9745) and a Sunset header (RFC 8594) with the removal date, and the change is announced in the changelog at least 90 days before removal. Nothing is deprecated today. Rate limits Uncached endpoints on www.stuntdouble.io (health, the public docs MCP server, and error responses under /api) allow 120 requests per minute per client, and say so on every response with the IETF RateLimit headers: RateLimit-Policy: \"public-api\";q=120;w=60 RateLimit: \"public-api\";r=119;t=60 r is the requests left and t the seconds until the window resets. Over the limit, the response is a 429 with a Retry-After header and a JSON body whose error.code is rate_limited. Wait that many seconds before retrying. Public docs MCP server Agents that have not signed in can still connect over MCP. A read-only server at https://www.stuntdouble.io/api/docs-mcp needs no authentication and exposes Stunt Double's documentation as resources: llms.txt, the homepage as Markdown, the OpenAPI spec and the MCP manifest. It has no tools; to act on a workspace, connect to the product server above. A POST to https://www.stuntdouble.io/.well-known/mcp reaches the same docs server. Discovery The platform publishes a manifest at https://www.stuntdouble.io/.well-known/mcp.json describing the server, its transport, authentication, and tools. MCP registries and clients use this to discover the integration. The same manifest is served at https://www.stuntdouble.io/.well-known/mcp. Each MCP server also has a server card on the host that serves it: the docs server's at https://www.stuntdouble.io/.well-known/mcp/server-card.json, the product server's at https://app.stuntdouble.io/.well-known/mcp/server-card.json. The AI Catalogue at https://www.stuntdouble.io/.well-known/ai-catalog.json lists both. The OAuth metadata documents are served on this site as well as on app.stuntdouble.io, and name app.stuntdouble.io as the issuer either way. The public HTTP endpoints on this site (discovery files, health, the desktop release feed, and the MCP entry point) are described by the Stunt Double OpenAPI spec at https://www.stuntdouble.io/openapi.json. Agents can also read the site as Markdown: /llms.txt says when to use Stunt Double and how to connect, and the homepage returns Markdown to requests that send Accept: text/markdown." }, "stepIndex": 15 } - 2026-10-04T21:45:44.324346+00:00 · tool_call · done
{ "step": { "ts": "2026-10-04T21:45:43.926Z", "kind": "tool_call", "name": "done", "input": { "message": "API docs URL: https://www.stuntdouble.io/support/docs/api. It documents an MCP server at https://app.stuntdouble.io/api/mcp, which uses the Streamable HTTP transport.\nAuth model: OAuth 2.1 with scoped tokens. MCP clients discover the authorisation and token endpoints automatically. A client that requests no scope is granted all three scopes. The docs don't mention API keys.\nScopes:\n- mcp:read: read workspaces and their contents (projects, actors, checklists, interviews, workflows, results).\n- mcp:write: create and edit projects, actors, knowledge, guidelines, checklists, interviews and workflows.\n- mcp:run: start checklist runs, workflow runs and interviews, which use the workspace run allowance." } }, "stepIndex": 16 }