MCP authorization
A protected MCP endpoint's OAuth discovery chain: 401 → protected-resource metadata → authorization-server metadata (PKCE). (live probe)
Broken variant
Exercised on the authbroken host: the authorization-server metadata omits PKCE (code_challenge_methods_supported: S256). On the broken host mcpAuth is absent (the broken card can't advertise a discoverable endpoint).
Catalogued flags
| Flag | Kind | Severity |
|---|---|---|
mcpAuthMissingResourceMetadata | defect | high |
mcpAuthMalformedResourceMetadata | defect | high |
mcpAuthResourceMismatch | defect | high |
mcpAuthMissingAuthorizationServer | defect | high |
mcpAuthInvalidAuthorizationServerUrl | defect | high |
mcpAuthMissingAuthorizationServerMetadata | defect | high |
mcpAuthMalformedAuthorizationServerMetadata | defect | high |
mcpAuthAuthorizationServerIssuerMismatch | defect | high |
mcpAuthMissingPkceSupport | defect | high |
mcpAuthPartiallyAssessed | coverage note — not a finding about the site | — |