OMCP OAuth Lab

REMOTE MCP AUTH · PREFLIGHT

Make OAuth discovery boringly correct.

Paste the two metadata documents used by a remote MCP deployment. The validator checks relationships—not just JSON syntax—and explains what a client is likely to reject.

RFC 9728OAuth metadataPKCE S256Local-only

METADATA CHAIN

MCP OAuth validator

Paste both metadata documents to inspect discovery, endpoints, issuer linkage, PKCE, registration, and scopes.

01

Discovery path

Checks the resource identifier and generates the well-known URL clients should request.

02

Trust relationship

Compares protected resource metadata with the authorization server issuer and advertised server list.

03

OAuth endpoints

Flags insecure authorization, token, registration, JWKS, revocation, and introspection endpoints.

04

Client compatibility

Checks authorization code support, PKCE S256, response modes, token auth methods, and scopes.

WHY THIS BREAKS

Remote MCP authentication is a chain of metadata decisions.

A protected resource tells the client which authorization servers may issue tokens for it. The client then discovers an authorization server, negotiates registration where supported, creates a PKCE challenge, and sends the resource identifier through the flow. A syntactically valid document can still fail when those values disagree.

High-confidence checks

  • HTTPS and exact origin handling
  • Resource and issuer identity
  • Authorization server linkage
  • Authorization code and PKCE S256
  • Endpoint URL credential leakage

Outside this static scan

  • Live CORS and HTTP status behavior
  • Token signature and audience validation
  • Dynamic registration policy
  • Redirect URI enforcement
  • Actual scope authorization
RFC 9728 protected resource metadataField-by-field MCP guide →MCP PKCE checkerValidate S256 compatibility →MCP OAuth debugging checklistFollow the discovery chain →