Demo MCP server

Intentionally vulnerable. Scan it to see what each finding looks like.

Do not point real clients at this. The /authorize endpoint accepts any redirect_uri and hands back fake tokens. It exists so patchbay audit has something safe to demonstrate findings against without probing third-party servers.

Try it

npx -y @patchbay-nebius/agent audit https://patchbay-mcp.dev/demo/mcp
# or with the opt-in headless OAuth battery:
npx -y @patchbay-nebius/agent audit https://patchbay-mcp.dev/demo/mcp --probe-headless-oauth

Bugs this server ships on purpose

Check	What's wrong
`AUTH-001`	`tools/list` succeeds without credentials
`AUTH-003`	OAuth metadata lists only `plain` PKCE, no S256
`RESOURCE-001`	Protected Resource Metadata missing `authorization_servers`
`SCOPE-001`	Every tool uses one scope (`read`)
`HEADERS-001`	Wildcard CORS with credentials, no HSTS, no X-Frame, no nosniff
`POISONING-001`	Zero-width Unicode and `<SYSTEM>` marker in a tool description
`ISS-001`	`authorization_response_iss_parameter_supported: false`
`PKCE-001`	`/authorize` issues a code with no `code_challenge` (opt-in probe)
`PKCE-002`	Plain PKCE accepted (opt-in probe)
`IMPLICIT-001`	`response_type=token` honoured (opt-in probe)
`REDIRECT-002`	Unregistered `redirect_uri` accepted (opt-in probe)

Endpoints

/demo/mcp — MCP endpoint (POST JSON-RPC, GET info)
/demo/.well-known/oauth-authorization-server — AS metadata
/demo/.well-known/oauth-protected-resource — PRM
/demo/authorize — crafted-request-accepting auth endpoint
/demo/token — fake token endpoint

Source lives in apps/web/app/demo in the patchbay repo. Every bug is annotated with the check ID it triggers.