Strategy Studio
Designed and built it. Live in production.
Competitive research becomes something you can ask questions of from inside Claude, scoped to a single workspace, read only, revocable. No copy and paste between systems.
Next.js · TypeScript · Supabase · OAuth 2.1 · MCP · Anthropic + Google · Apify · Vercel
Strategy Studio captures competitor ads from Meta and TikTok into a workspace per client, then turns the pile into readouts. The point is not the ad wall, it is the pattern underneath it, so a brief opens with what the category is already running.
The harder half is the access layer. Claude connects to it as a remote MCP server through an OAuth 2.1 authorization server I built: dynamic client registration, authorization code flow with PKCE, scoped tokens bound to a single workspace, and a consent screen that tells a non-technical person exactly what they are granting.
Access tokens last an hour, refresh tokens last thirty days and rotate on every use. The old token is revoked in the same operation that issues the new one, guarded so a replayed refresh token is detected rather than honoured. Tokens are only ever stored as hashes.
That is the part worth paying attention to. Plenty of people have connected an AI tool to a database. Far fewer have built the authorization layer that makes it safe to let an agent into a system that holds more than one client's data.
- Application
- 28,301 lines of TypeScript, 157 files
- Surface
- 19 pages, 57 API routes
- Tenancy
- Workspaces with members, scoped end to end
- Agent access
- OAuth 2.1 with PKCE, per-workspace tokens
- Token handling
- SHA-256 at rest, rotation with reuse detection
- Retrieval
- Embeddings and a knowledge layer
- Production
- Sentry, Upstash rate limiting, PostHog
Check it yourself
The authorization server is live. These are public endpoints, so you can confirm the whole thing without asking me anything.
curl -i https://strategy-studio.vercel.app/.well-known/oauth-protected-resourceProtected resource metadata. Returns 200, RFC 9728 metadata naming the resource and its scopes.
curl -i https://strategy-studio.vercel.app/.well-known/oauth-authorization-serverAuthorization server metadata. Returns 200, RFC 8414 metadata with the full endpoint set.
curl -i https://strategy-studio.vercel.app/api/mcpThe MCP endpoint itself. Returns 401 with a WWW-Authenticate bearer challenge pointing back at the metadata.