///// Free tools
MCP Sign-In Checker
Check the whole sign-in chain a host follows, and on your own server prove each host's callback can register.
agent-auth-www-authenticateUNRESOLVEDoauth-protected-resourceUNRESOLVEDmcp-oauth-metadataUNRESOLVEDmcp-pkce-s256UNRESOLVEDagent-auth-endpoints-reachableUNRESOLVED
example.com has no MCP server, so these stay unresolved. See the sample report
Run it now
From any terminal, with Node.js. Nothing to install on your server and no account.
--register is for your own server only. It registers one OAuth client per AI host callback and lists every client it created, so you can delete them.
Run it here
See a sample report from a real scan of example.com.
What it checks
agent-auth-www-authenticateThe first step of sign-in: whether an anonymous request to your server gets a 401 with a WWW-Authenticate header that points to your protected-resource metadata.oauth-protected-resourceWhether your server publishes protected-resource metadata (RFC 9728) naming its authorization servers.mcp-oauth-metadataWhether your authorization server publishes its metadata (RFC 8414) with the endpoints a host needs.mcp-pkce-s256Whether your authorization server advertises PKCE with the S256 method.agent-auth-endpoints-reachableWhether the registration and other sign-in endpoints your discovery documents advertise actually respond.