# MCP Sign-In Checker

Check the whole sign-in chain a host follows, and on your own server prove each host's callback can register.

```sh
npx backwatch your-site.com --register
```

## What it checks

- [agent-auth-www-authenticate](https://backwatch.dev/checks/agent-auth-www-authenticate.md)
- [oauth-protected-resource](https://backwatch.dev/checks/oauth-protected-resource.md)
- [mcp-oauth-metadata](https://backwatch.dev/checks/mcp-oauth-metadata.md)
- [mcp-pkce-s256](https://backwatch.dev/checks/mcp-pkce-s256.md)
- [agent-auth-endpoints-reachable](https://backwatch.dev/checks/agent-auth-endpoints-reachable.md)

Running it from backwatch.dev is coming with the hosted monitor.