Static credential accepted, no OAuth discovery
Server accepts bearer or API-key auth but serves no .well-known OAuth metadata.
What it means
The server accepts an Authorization: Bearer or x-api-key header (patchbay confirmed this with a probe token that returned 2xx), but neither /.well-known/oauth-protected-resource nor /.well-known/oauth-authorization-server is served. MCP clients that follow the spec cannot negotiate PKCE, scopes or resource indicators. They have to be configured out of band with a static credential.
How to fix
Replace static credentials with OAuth 2.1. Publish discovery metadata at the two well-known paths so clients can auto-configure. Support PKCE with S256, resource indicators (RFC 8707) and dynamic client registration (RFC 7591).
Spec
MCP authorization spec (2025-06-18)Run the check against your own server:
npx -y @patchbay-nebius/agent audit <url-or-directory>No install: scan an MCP server in the browser and get a shareable report.
Disagree with this finding on your server? Open an issue with the --json output. False-positive reports are the most useful feedback.