///// Checks / Connectability
Agent auth WWW-Authenticate hint
The first step of sign-in: whether an anonymous request to your server gets a 401 with a WWW-Authenticate header that points to your protected-resource metadata.
- Check id
agent-auth-www-authenticate- Pillar
- Connectability
- Runs in
- The free CLI
- Scoring
- Always counted when there is an MCP server
- Status
- Pre-release, in calibration
Why it matters
Without that pointer the host has no way to find your authorization server, so sign-in stops before any login page. It's the most common break in our registry study.
How to pass
Return 401 with WWW-Authenticate: Bearer resource_metadata="https://your-server/.well-known/oauth-protected-resource".
Run it
Find agent-auth-www-authenticate in the report. Add --md for a fix prompt you can paste into Claude Code, Codex or Cursor.