MCP authorization correct variant
A protected MCP endpoint's OAuth discovery chain: 401 → protected-resource metadata → authorization-server metadata (PKCE).
Live probe — one per host.
This signal isn't a page; the container probes it at a fixed path, and the
correct/broken/authbroken variant is chosen by the request host. On this host the canonical path(s)
below serve the correct variant. Add
?mode=… to override locally.
Canonical path(s)
Broken variant
Exercised on the authbroken host: the authorization-server metadata omits PKCE (code_challenge_methods_supported: S256). On the broken host mcpAuth is absent (the broken card can't advertise a discoverable endpoint).
Catalogued flags
| Flag | Kind | Severity |
|---|---|---|
mcpAuthMissingResourceMetadata | defect | high |
mcpAuthMalformedResourceMetadata | defect | high |
mcpAuthResourceMismatch | defect | high |
mcpAuthMissingAuthorizationServer | defect | high |
mcpAuthInvalidAuthorizationServerUrl | defect | high |
mcpAuthMissingAuthorizationServerMetadata | defect | high |
mcpAuthMalformedAuthorizationServerMetadata | defect | high |
mcpAuthAuthorizationServerIssuerMismatch | defect | high |
mcpAuthMissingPkceSupport | defect | high |
mcpAuthPartiallyAssessed | coverage note — not a finding about the site | — |
Fetch the live file: https://agentic-mcp-strict.crawler-test.com/mcp-protected