OMCP OAuth Lab

REMOTE MCP AUTH · PREFLIGHT

Make OAuth discovery boringly correct.

Paste the two metadata documents used by a remote MCP deployment. The validator checks relationships—not just JSON syntax—and explains what a client is likely to reject.

RFC 9728OAuth metadataPKCE S256Local-only

METADATA CHAIN

MCP OAuth validator

Paste both metadata documents to inspect discovery, endpoints, issuer linkage, PKCE, registration, and scopes.

01

Discovery path

Checks the resource identifier and generates the well-known URL clients should request.

02

Trust relationship

Compares protected resource metadata with the authorization server issuer and advertised server list.

03

OAuth endpoints

Flags insecure authorization, token, registration, JWKS, revocation, and introspection endpoints.

04

Client compatibility

Checks authorization code support, PKCE S256, response modes, token auth methods, and scopes.

WHY THIS BREAKS

Remote MCP authentication is a chain of metadata decisions.

A protected resource tells the client which authorization servers may issue tokens for it. The client then discovers an authorization server, negotiates registration where supported, creates a PKCE challenge, and sends the resource identifier through the flow. A syntactically valid document can still fail when those values disagree.

High-confidence checks

  • HTTPS and exact origin handling
  • Resource and issuer identity
  • Authorization server linkage
  • Authorization code and PKCE S256
  • Endpoint URL credential leakage

Outside this static scan

  • Live CORS and HTTP status behavior
  • Token signature and audience validation
  • Dynamic registration policy
  • Redirect URI enforcement
  • Actual scope authorization
RFC 9728 protected resource metadataField-by-field MCP guide →MCP PKCE checkerValidate S256 compatibility →MCP OAuth debugging checklistFollow the discovery chain →

PURPOSE & METHODOLOGY

A focused tool, with the context to use it well

MCP OAuth Lab was created to debug MCP OAuth metadata, PKCE values, and protected-resource discovery. It is intended for developers implementing authentication for remote MCP servers. The tool is free, requires no account, and is paired with original explanations so you can understand the result rather than copy an unexplained output.

How to use the result

Start with a sample or a non-sensitive copy of your data, run the check, and review every finding before changing a production project. The site separates protocol checks from security advice and explains why each field matters. It does not request access tokens and should never be used to paste live client secrets. Specifications and software evolve, so confirm high-impact decisions against the linked primary documentation.

Privacy and limitations

OAuth metadata and debugging values is processed in your browser wherever the tool page states that local processing is used. Avoid entering passwords, access tokens, personal data, or confidential material. Automated output may be incomplete because it cannot know your entire deployment, threat model, or organizational policy.

Independent and transparent

This is an independent developer resource, not an official certification service. Source code and issue tracking are available on GitHub. Read more about the project, review the privacy policy, or report an error.