TikTok for Business MCP Server

TikTok publishes its own MCP server for the TikTok Ads platform, on its developer portal rather than through the official registry. The docs describe it as packaging roughly 400 TikTok API for Business endpoints as MCP tools, covering campaign creation and lifecycle management, reporting, catalogs, creative assets, audiences and Business Center administration.

The unusual part is that it ships in two shapes at two paths under /open_mcp/. tt-ads-mcp-flat loads the whole tool library when the client connects. tt-ads-mcp-layer loads around 40 core tools and makes the rest discoverable on demand, which the docs frame as the choice for agents with smaller context windows. Tokens do not cross between them: a token issued for one path is scoped to that path, so an agent using both completes two authorization flows.

Authorization is OAuth 2.0 throughout, with dynamic client registration so an agent can obtain a client_id at runtime, and PKCE with S256. Clients are told to read the authorization server metadata from /open_mcp/{server}/oauth/.well-known/openid-configuration rather than hardcoding endpoints. Access tokens last 24 hours and refresh tokens 30 days. Tool calls are JSON-RPC 2.0 POSTs to the server URL carrying an Authorization: Bearer header, and the documented example uses tools/list.

A probe of the tt-ads-mcp-layer endpoint returned 401 with a Bearer challenge carrying an RFC 9728 resource_metadata pointer, which confirms the endpoint is live and OAuth-protected but leaves the capability set unobservable without credentials. No TikTok surface names a supported MCP revision, so spec support is recorded as unverified. There is no registry record under a TikTok namespace; searching the official registry for "tiktok" returns only third-party servers.