# Sites with broken MCP authorization discovery A site-wide report: one row per host, over the mcp\_auth rows the crawl emitted. ## What this report returns When an MCP server is protected (it answers unauthenticated requests with 401), agents authenticate by walking an OAuth discovery chain: the 401 points at protected-resource metadata (RFC 9728), which names authorization servers, whose metadata (RFC 8414) provides the endpoints and PKCE support. A row appears here when any of these is wrong, worst first: - **Missing Resource Metadata**The server challenges with 401 but publishes no OAuth Protected Resource Metadata (no `resource_metadata` pointer in WWW-Authenticate and nothing at the well-known URL), so an agent can't even begin authorizing.**Fix** Publish RFC 9728 metadata at `/.well-known/oauth-protected-resource` and point the 401 at it. - **Malformed Resource Metadata**The protected-resource metadata isn't a JSON object or omits its required `"resource"` field (RFC 9728), so it can't be interpreted.**Fix** Serve a JSON object carrying `"resource"` and `"authorization_servers"`. - **Resource Mismatch**The metadata's `"resource"` doesn't exactly match what it describes, which RFC 9728 requires: the challenged MCP endpoint, or the bare origin for metadata at the site's root, so clients must reject it, since the match is what stops another server impersonating yours.**Fix** Set `"resource"` to the endpoint URL character for character, or serve that metadata at the endpoint's own well-known URL. - **Missing Authorization Server**The protected-resource metadata names no usable authorization server; MCP requires `authorization_servers` with at least one entry, so agents don't know where to get a token.**Fix** List the issuer URL(s) in `"authorization_servers"`. - **Invalid Authorization Server URL**An `authorization_servers` entry isn't an absolute http(s) issuer URL, so its metadata can't be discovered.**Fix** List each server as a full issuer URL, e.g. `"https://auth.example.com"`. - **Missing Authorization Server Metadata**The advertised authorization server publishes no metadata at its RFC 8414 / OpenID Connect discovery well-known URL, so an agent can't find the OAuth endpoints.**Fix** Serve metadata at `/.well-known/oauth-authorization-server` (or the OIDC equivalent) on the issuer. - **Malformed Authorization Server Metadata**The authorization-server metadata isn't a JSON object or omits `authorization_endpoint` / `token_endpoint` (RFC 8414), so the OAuth flow can't run.**Fix** Include both endpoints as absolute URLs in the metadata. - **Authorization Server Issuer Mismatch**The metadata's `"issuer"` doesn't exactly match the identifier it was discovered from, which RFC 8414 requires, so clients must not use it, since the match is what stops another server impersonating it.**Fix** Set issuer to the exact URL the server is advertised under. - **Missing PKCE Support**The authorization server doesn't advertise `code_challenge_methods_supported` including S256; MCP mandates PKCE, so a compliant client must refuse to proceed.**Fix** Enable PKCE with S256 and advertise it in the server metadata. - **Private Key Exposed**An advertised public key set contains private or symmetric key material, allowing readers to impersonate the signer.**Fix** Remove private members, rotate the exposed keys and publish only public verification keys. - **Unsigned Signing Algorithm**Resource signing or authorization-server client authentication advertises the unsigned algorithm none where the metadata specification forbids it.**Fix** Remove none from those lists and advertise supported signing algorithms. - **Insecure Endpoint**An advertised authorization server, or an authorization, token or registration endpoint in its metadata, isn't https (plain http, or a javascript:, data: or file: URL), so sign-in, codes and tokens travel unencrypted or a client is handed a link it must never open. MCP requires HTTPS for every one.**Fix** Serve each over https and advertise its https:// URL. Discovery defects include specification requirements; query-token delivery and minimum key-strength observations make no conformance claim. Triage by the Security Risk Detected column first; those rows also appear in the report of unsafe MCP authorization setups. (A request for `offline_access` is shown for context but is informational.) Security checks are provisional; precision has not yet been measured. A clean row is not a security assessment. ## The columns it shows Every defect this technology can carry is a column in the grid, worst first, so nothing is hidden behind a filter you have to know to apply. - Host`host` - MCP Authorization Valid`mcpAuthValid` - MCP Authorization Conformance Issue Detected`mcpAuthConformanceIssueDetected` - MCP Authorization Security Risk Detected`mcpAuthSecurityRiskDetected` - MCP Auth Findings`mcpAuthFindings` - MCP Auth Challenged Endpoint URL`mcpAuthChallengedEndpointUrl` - MCP Auth Declared Resource Value`mcpAuthDeclaredResourceValue` - MCP Auth Authorization Servers`mcpAuthAuthorizationServerUrls` - MCP Auth Missing Resource Metadata`mcpAuthMissingResourceMetadata` - MCP Auth Malformed Resource Metadata`mcpAuthMalformedResourceMetadata` - MCP Auth Resource Mismatch`mcpAuthResourceMismatch` - MCP Auth Missing Authorization Server`mcpAuthMissingAuthorizationServer` - MCP Auth Invalid Authorization Server URL`mcpAuthInvalidAuthorizationServerUrl` - MCP Auth Missing Authorization Server Metadata`mcpAuthMissingAuthorizationServerMetadata` - MCP Auth Malformed Authorization Server Metadata`mcpAuthMalformedAuthorizationServerMetadata` - MCP Auth Authorization Server Issuer Mismatch`mcpAuthAuthorizationServerIssuerMismatch` - MCP Auth Missing PKCE Support`mcpAuthMissingPkceSupport` - MCP Auth Private Key Exposed`mcpAuthPrivateKeyExposed` - MCP Auth Unsigned Signing Algorithm`mcpAuthUnsignedSigningAlgorithm` - MCP Auth Insecure Endpoint`mcpAuthInsecureEndpoint` - MCP Weak RSA Key`mcpAuthWeakRsaKey` - MCP Authorization Known Test Key`mcpAuthTestKey` - MCP Query Bearer Method`mcpAuthQueryBearerMethod` - MCP Auth Offline Access Scope`mcpAuthOfflineAccessScope` - MCP Authorization Partially Assessed`mcpAuthPartiallyAssessed` - Ruleset Version`rulesetVersion` - Security Check Status`securityCheckStatus` - Related Security Frameworks`securityFrameworkReferences` ## About MCP authorization The OAuth discovery chain protecting that MCP endpoint. [Read how MCP authorization is checked](https://agentic-readiness.lumar.io/docs/capabilities/mcp-auth), including the specification it is validated against and a worked correct and broken example. ## Running it This report comes with Agentic Readiness in Lumar and appears on every crawl of any project that has it turned on. [See the whole set](https://agentic-readiness.lumar.io/scan-at-scale), or check a single URL with the [scanner on this site](https://agentic-readiness.lumar.io/), which runs the same code with no account. [Get Lumar pricing →](https://www.lumar.io/pricing/)