///// Free tools
MCP OAuth Discovery Tester
Follow the discovery half of MCP sign-in: the 401 challenge, protected-resource metadata and authorization-server metadata.
agent-auth-www-authenticateUNRESOLVEDoauth-protected-resourceUNRESOLVEDmcp-oauth-metadataUNRESOLVEDagent-auth-discovery-metadataUNRESOLVED
example.com has no MCP server, so these stay unresolved. See the sample report
Run it now
From any terminal, with Node.js. Nothing to install on your server and no account.
This runs the connectability pillar. The checks below are in the report.
Run it here
See a sample report from a real scan of example.com.
What it checks
agent-auth-www-authenticateThe first step of sign-in: whether an anonymous request to your server gets a 401 with a WWW-Authenticate header that points to your protected-resource metadata.oauth-protected-resourceWhether your server publishes protected-resource metadata (RFC 9728) naming its authorization servers.mcp-oauth-metadataWhether your authorization server publishes its metadata (RFC 8414) with the endpoints a host needs.agent-auth-discovery-metadataWhether your OAuth discovery documents carry the agent sign-in details your auth docs describe.