# MCP PKCE S256 support

Check id `mcp-pkce-s256` · Connectability · runs in the free CLI · pre-release, in calibration

**What we look for.** Whether your authorization server advertises PKCE with the S256 method.

**Why it matters.** MCP hosts require PKCE. A server that doesn't advertise S256 can be refused by the host.

**How to pass.** Support PKCE and list code_challenge_methods_supported: ["S256"] in your authorization-server metadata.

Run it: `npx backwatch your-site.com --pillar connectability` and find `mcp-pkce-s256` in the report.