agentic‑readiness docs
/
Scan at scale Blog Build one › Run a scan ›
Menu

Scan at scaleSites with broken MCP authorization discovery

Sites with broken MCP authorization discovery

A site-wide report: one row per host, over the mcp_auth rows the crawl emitted.

What this report returns

When an MCP server is protected (it answers unauthenticated requests with 401), agents authenticate by walking an OAuth discovery chain: the 401 points at protected-resource metadata (RFC 9728), which names authorization servers, whose metadata (RFC 8414) provides the endpoints and PKCE support.

A row appears here when any of these is wrong, worst first:

  • Missing Resource MetadataThe server challenges with 401 but publishes no OAuth Protected Resource Metadata (no resource_metadata pointer in WWW-Authenticate and nothing at the well-known URL), so an agent can't even begin authorizing.Fix Publish RFC 9728 metadata at /.well-known/oauth-protected-resource and point the 401 at it.
  • Malformed Resource MetadataThe protected-resource metadata isn't a JSON object or omits its required "resource" field (RFC 9728), so it can't be interpreted.Fix Serve a JSON object carrying "resource" and "authorization_servers".
  • Resource MismatchThe metadata's "resource" doesn't exactly match what it describes, which RFC 9728 requires: the challenged MCP endpoint, or the bare origin for metadata at the site's root, so clients must reject it, since the match is what stops another server impersonating yours.Fix Set "resource" to the endpoint URL character for character, or serve that metadata at the endpoint's own well-known URL.
  • Missing Authorization ServerThe protected-resource metadata names no usable authorization server; MCP requires authorization_servers with at least one entry, so agents don't know where to get a token.Fix List the issuer URL(s) in "authorization_servers".
  • Invalid Authorization Server URLAn authorization_servers entry isn't an absolute http(s) issuer URL, so its metadata can't be discovered.Fix List each server as a full issuer URL, e.g. "https://auth.example.com".
  • Missing Authorization Server MetadataThe advertised authorization server publishes no metadata at its RFC 8414 / OpenID Connect discovery well-known URL, so an agent can't find the OAuth endpoints.Fix Serve metadata at /.well-known/oauth-authorization-server (or the OIDC equivalent) on the issuer.
  • Malformed Authorization Server MetadataThe authorization-server metadata isn't a JSON object or omits authorization_endpoint / token_endpoint (RFC 8414), so the OAuth flow can't run.Fix Include both endpoints as absolute URLs in the metadata.
  • Authorization Server Issuer MismatchThe metadata's "issuer" doesn't exactly match the identifier it was discovered from, which RFC 8414 requires, so clients must not use it, since the match is what stops another server impersonating it.Fix Set issuer to the exact URL the server is advertised under.
  • Missing PKCE SupportThe authorization server doesn't advertise code_challenge_methods_supported including S256; MCP mandates PKCE, so a compliant client must refuse to proceed.Fix Enable PKCE with S256 and advertise it in the server metadata.
  • Private Key ExposedAn advertised public key set contains private or symmetric key material, allowing readers to impersonate the signer.Fix Remove private members, rotate the exposed keys and publish only public verification keys.
  • Unsigned Signing AlgorithmResource signing or authorization-server client authentication advertises the unsigned algorithm none where the metadata specification forbids it.Fix Remove none from those lists and advertise supported signing algorithms.
  • Insecure EndpointAn advertised authorization server, or an authorization, token or registration endpoint in its metadata, isn't https (plain http, or a javascript:, data: or file: URL), so sign-in, codes and tokens travel unencrypted or a client is handed a link it must never open. MCP requires HTTPS for every one.Fix Serve each over https and advertise its https:// URL.

Discovery defects include specification requirements; query-token delivery and minimum key-strength observations make no conformance claim. Triage by the Security Risk Detected column first; those rows also appear in the report of unsafe MCP authorization setups.

(A request for offline_access is shown for context but is informational.)

Security checks are provisional; precision has not yet been measured. A clean row is not a security assessment.

The columns it shows

Every defect this technology can carry is a column in the grid, worst first, so nothing is hidden behind a filter you have to know to apply.

  • Hosthost
  • MCP Authorization ValidmcpAuthValid
  • MCP Authorization Conformance Issue DetectedmcpAuthConformanceIssueDetected
  • MCP Authorization Security Risk DetectedmcpAuthSecurityRiskDetected
  • MCP Auth FindingsmcpAuthFindings
  • MCP Auth Challenged Endpoint URLmcpAuthChallengedEndpointUrl
  • MCP Auth Declared Resource ValuemcpAuthDeclaredResourceValue
  • MCP Auth Authorization ServersmcpAuthAuthorizationServerUrls
  • MCP Auth Missing Resource MetadatamcpAuthMissingResourceMetadata
  • MCP Auth Malformed Resource MetadatamcpAuthMalformedResourceMetadata
  • MCP Auth Resource MismatchmcpAuthResourceMismatch
  • MCP Auth Missing Authorization ServermcpAuthMissingAuthorizationServer
  • MCP Auth Invalid Authorization Server URLmcpAuthInvalidAuthorizationServerUrl
  • MCP Auth Missing Authorization Server MetadatamcpAuthMissingAuthorizationServerMetadata
  • MCP Auth Malformed Authorization Server MetadatamcpAuthMalformedAuthorizationServerMetadata
  • MCP Auth Authorization Server Issuer MismatchmcpAuthAuthorizationServerIssuerMismatch
  • MCP Auth Missing PKCE SupportmcpAuthMissingPkceSupport
  • MCP Auth Private Key ExposedmcpAuthPrivateKeyExposed
  • MCP Auth Unsigned Signing AlgorithmmcpAuthUnsignedSigningAlgorithm
  • MCP Auth Insecure EndpointmcpAuthInsecureEndpoint
  • MCP Weak RSA KeymcpAuthWeakRsaKey
  • MCP Authorization Known Test KeymcpAuthTestKey
  • MCP Query Bearer MethodmcpAuthQueryBearerMethod
  • MCP Auth Offline Access ScopemcpAuthOfflineAccessScope
  • MCP Authorization Partially AssessedmcpAuthPartiallyAssessed
  • Ruleset VersionrulesetVersion
  • Security Check StatussecurityCheckStatus
  • Related Security FrameworkssecurityFrameworkReferences

About MCP authorization

The OAuth discovery chain protecting that MCP endpoint.

Read how MCP authorization is checked, including the specification it is validated against and a worked correct and broken example.

Running it

This report comes with Agentic Readiness in Lumar and appears on every crawl of any project that has it turned on. See the whole set, or check a single URL with the scanner on this site, which runs the same code with no account.

Get Lumar pricing