///// Checks / Connectability
OAuth Protected Resource metadata (RFC 9728)
Whether your server publishes protected-resource metadata (RFC 9728) naming its authorization servers.
- Check id
oauth-protected-resource- Pillar
- Connectability
- Runs in
- The free CLI
- Scoring
- Always counted when there is an MCP server
- Status
- Pre-release, in calibration
Why it matters
It's the second step of the chain: the host reads it to learn where to send the user to sign in.
How to pass
Serve /.well-known/oauth-protected-resource as JSON with resource and authorization_servers.
Run it
Find oauth-protected-resource in the report. Add --md for a fix prompt you can paste into Claude Code, Codex or Cursor.