DocsCapabilitiesMCP authorization
MCP authorization
The OAuth discovery chain protecting that MCP endpoint.
Set up MCP authorization on your site
The discovery chain an agent follows from a 401, and the two documents that have to exist for it to work.
Free
Set up MCP authorization
Why an agent cares
An agent that meets a 401 has to discover where to authenticate, and the spec makes that chain mandatory for remote servers. Partial implementations are the norm rather than the exception, which is exactly the present-but-wrong shape this container looks for.
Adoption
Early production. Several independent organisations run it in production, though it is still niche on the open web.
Direction of travel: ▲ rising, as at .
Mandatory in the spec and shipped by the big hosted servers, but Astrix Security found only 8.5% of MCP servers use OAuth at all (Mar 2026).
| Adopter | Depth | Evidence |
|---|---|---|
| Cloudflare (workers-oauth-provider, full chain) | production | blog.cloudflare.com |
| GitHub, Stripe, Linear, Sentry | production | hidekazu-konishi.com |
| Atlassian (shipped GA without RFC 9728 metadata, later fixed) | production | github.com |
What we check
Absence is never a finding. Every check below runs only once
mcpAuthPresent is true, so a site that has not adopted this is not assessed on it and appears in no report. 9 of these 10 can fail it. In a Lumar crawl these land on one row per site, in the crawl-level table where itemType is mcp_auth.| Check | Severity | Raises | On whose authority |
|---|---|---|---|
mcpAuthMissingResourceMetadata | high | conformance, usability | specification (MCP authorization 2026-07-28 (profiling RFC 9728)) |
mcpAuthMalformedResourceMetadata | high | conformance, usability | specification (RFC 9728) |
mcpAuthResourceMismatch | high | conformance, usability | specification (RFC 9728) |
mcpAuthMissingAuthorizationServer | high | conformance, usability | specification (MCP authorization 2026-07-28) |
mcpAuthInvalidAuthorizationServerUrl | high | conformance, usability | specification (RFC 8414) |
mcpAuthMissingAuthorizationServerMetadata | high | conformance, usability | specification (RFC 8414 / OIDC Discovery 1.0 (per SEP-2351, the default RFC 8414 suffix)) |
mcpAuthMalformedAuthorizationServerMetadata | high | conformance, usability | specification (RFC 8414) |
mcpAuthAuthorizationServerIssuerMismatch | high | conformance, usability, security | specification (RFC 8414) |
mcpAuthMissingPkceSupport | high | conformance, usability, security | specification (MCP authorization 2026-07-28, Security Considerations → Authorization Code Protection) |
mcpAuthPartiallyAssessed | coverage note | nothing | our own coverage |
Specifications
| Document | Revision | Kind |
|---|---|---|
| MCP Authorization | 2026-07-28 | specification |
| MCP authorization server discovery | 2026-07-28 | specification |
| RFC 9728 — OAuth Protected Resource Metadata | RFC 9728 | specification |
| RFC 8414 — OAuth Authorization Server Metadata | RFC 8414 | specification |
| RFC 8707 — OAuth Resource Indicators | RFC 8707 | specification |
| OpenID Connect Discovery 1.0 | 1.0 | specification |
Last re-read against the published documents: .