MCP authorization

Supporting documents: MCP Authorization, OAuth Protected Resource Metadata

Required by MCP Authorization and OAuth Protected Resource Metadata. Bad: the server challenges with 401 but publishes no OAuth Protected Resource Metadata (no resource_metadata pointer in WWW-Authenticate and nothing at the well-known URL), so an agent can't even begin authorizing. Fix: publish RFC 9728 metadata at /.well-known/oauth-protected-resource and point the 401 at it.

Supporting documents: OAuth Protected Resource Metadata

Required by OAuth Protected Resource Metadata. Bad: the protected-resource metadata isn't a JSON object or omits its required "resource" field (RFC 9728), so it can't be interpreted. Fix: serve a JSON object carrying "resource" and "authorization_servers".

Supporting documents: OAuth Protected Resource Metadata

Required by OAuth Protected Resource Metadata. Provisional security check; precision has not yet been measured. Bad: the metadata's "resource" doesn't exactly match what it describes, which RFC 9728 requires: the challenged MCP endpoint, or the bare origin for metadata at the site's root, so clients must reject it, since the match is what stops another server impersonating yours. Fix: set "resource" to the endpoint URL character for character, or serve that metadata at the endpoint's own well-known URL.

MCP identity or authentication metadata lacks an advertised protection.

Authorization decisions and authenticated tool execution are not tested. Related guidance does not establish exploitation or framework compliance. Security checks are provisional.

Supporting documents: MCP Authorization

Required by MCP Authorization. Bad: the protected-resource metadata names no usable authorization server; MCP requires authorization_servers with at least one entry, so agents don't know where to get a token. Fix: list the issuer URL(s) in "authorization_servers".

Supporting documents: OAuth Authorization Server Metadata

Required by OAuth Authorization Server Metadata. Bad: an authorization_servers entry isn't an absolute http(s) issuer URL, so its metadata can't be discovered. Fix: list each server as a full issuer URL, e.g. "https://auth.example.com".

Supporting documents: OAuth Authorization Server Metadata, OpenID Connect Discovery 1.0

Required by OAuth Authorization Server Metadata and OpenID Connect Discovery 1.0. Bad: the advertised authorization server publishes no metadata at its RFC 8414 / OpenID Connect discovery well-known URL, so an agent can't find the OAuth endpoints. Fix: serve metadata at /.well-known/oauth-authorization-server (or the OIDC equivalent) on the issuer.

Supporting documents: OAuth Authorization Server Metadata

Required by OAuth Authorization Server Metadata. Bad: the authorization-server metadata isn't a JSON object or omits authorization_endpoint / token_endpoint (RFC 8414), so the OAuth flow can't run. Fix: include both endpoints as absolute URLs in the metadata.

Supporting documents: OAuth Authorization Server Metadata

Required by OAuth Authorization Server Metadata. Provisional security check; precision has not yet been measured. Bad: the metadata's "issuer" doesn't exactly match the identifier it was discovered from, which RFC 8414 requires, so clients must not use it, since the match is what stops another server impersonating it. Fix: set issuer to the exact URL the server is advertised under.

Exposed identity material or weak authentication can enable identity misuse.

Actual credential use, permissions and privilege abuse are not tested. Related guidance does not establish exploitation or framework compliance. Security checks are provisional.

Supporting documents: MCP Authorization

Required by MCP Authorization. Provisional security check; precision has not yet been measured. Bad: the authorization server doesn't advertise code_challenge_methods_supported including S256; MCP mandates PKCE, so a compliant client must refuse to proceed. Fix: enable PKCE with S256 and advertise it in the server metadata.

MCP identity or authentication metadata lacks an advertised protection.

Authorization decisions and authenticated tool execution are not tested. Related guidance does not establish exploitation or framework compliance. Security checks are provisional.

Supporting documents: OpenID Connect Discovery 1.0, OAuth Authorization Server Metadata, OAuth Protected Resource Metadata

Required by OpenID Connect Discovery 1.0, OAuth Authorization Server Metadata and OAuth Protected Resource Metadata. Provisional security check; precision has not yet been measured. Bad: an advertised public key set contains private or symmetric key material, allowing readers to impersonate the signer. Fix: remove private members, rotate the exposed keys and publish only public verification keys.

Exposed identity material or weak authentication can enable identity misuse.

Actual credential use, permissions and privilege abuse are not tested. Related guidance does not establish exploitation or framework compliance. Security checks are provisional.

Supporting documents: OAuth Authorization Server Metadata, OAuth Protected Resource Metadata

Required by OAuth Authorization Server Metadata and OAuth Protected Resource Metadata. Provisional security check; precision has not yet been measured. Bad: resource signing or authorization-server client authentication advertises the unsigned algorithm none where the metadata specification forbids it. Fix: remove none from those lists and advertise supported signing algorithms.

MCP identity or authentication metadata lacks an advertised protection.

Authorization decisions and authenticated tool execution are not tested. Related guidance does not establish exploitation or framework compliance. Security checks are provisional.

Supporting documents: MCP Authorization

Required by MCP Authorization. Provisional security check; precision has not yet been measured. Bad: an advertised authorization server, or an authorization, token or registration endpoint in its metadata, isn't https (plain http, or a javascript:, data: or file: URL), so sign-in, codes and tokens travel unencrypted or a client is handed a link it must never open. MCP requires HTTPS for every one. Fix: serve each over https and advertise its https:// URL.

An advertised agent communication path lacks confidentiality.

Runtime message integrity and authorization are not tested. Related guidance does not establish exploitation or framework compliance. Security checks are provisional.

Supporting documents: HTTP Message Signatures, CFRG Elliptic Curves for JOSE, JSON Web Key, JSON Web Signature, Examples of Protecting Content Using JOSE

Lumar readiness bar: no specification requires this. An advertised MCP OAuth key set matches a published RFC test key whose private half is public.

Exposed identity material or weak authentication can enable identity misuse.

Actual credential use, permissions and privilege abuse are not tested. Related guidance does not establish exploitation or framework compliance. Security checks are provisional.

Supporting documents: JSON Web Algorithms

Client requirements in JSON Web Algorithms. Provisional security check; precision has not yet been measured. An advertised public key set carries a canonical RSA modulus below 2048 significant bits. RSA algorithm guidance sets the minimum for RSA algorithm use. Key usage and signatures are not tested. Fix: replace the weak key, internal destination or downgraded transport with the intended public secure configuration, as applicable.

A published RSA modulus is below the supported algorithms’ minimum key strength.

Only modulus size is checked; key generation, storage, runtime usage and signature verification are unassessed. Related guidance does not establish exploitation or framework compliance. Security checks are provisional.

Supporting documents: OAuth Bearer Token Usage

Lumar readiness bar: no specification requires this. Provisional security check; precision has not yet been measured. Protected-resource metadata explicitly advertises query bearer-token delivery. OAuth bearer-token guidance discourages query delivery because URLs are likely to be logged. No token is sent. Fix: replace the weak key, internal destination or downgraded transport with the intended public secure configuration, as applicable.

An MCP declaration exposes or routes credential material unsafely.

Token validity, scope and downstream compromise are not tested. Related guidance does not establish exploitation or framework compliance. Security checks are provisional.

Supporting documents: MCP Authorization

MCP Authorization permits this, so it never fails the site. Informational (does not fail mcpAuthValid): the MCP server lists offline_access in its metadata's scopes_supported or its 401 challenge, asking clients for a long-lived refresh token it doesn't need. MCP's 2026-07-28 revision advises against it; we can't see which revision a protected server follows. Consider removing it from both.