PKCE S256 not advertised
OAuth metadata exists but code_challenge_methods_supported does not include "S256".
What it means
OAuth 2.1 requires PKCE with S256 for all authorization code flows. The authorization server metadata at /.well-known/oauth-authorization-server either lacks the code_challenge_methods_supported field or lists only "plain". Clients cannot discover whether S256 is supported, so interoperable OAuth 2.1 flows cannot be established automatically. Confidence is medium: the server may enforce S256 at runtime without advertising it. This finding is about metadata completeness.
How to fix
Set "code_challenge_methods_supported": ["S256"] in your authorization server metadata response. Enforce S256 server-side on all authorization code requests; reject "plain" and absent code_challenge values.
Spec
RFC 9126 §5.2 (OAuth 2.1 PKCE)Background
MCP clients refuse to log in when PKCE is missing from your OAuth metadataRun the check against your own server:
npx -y @patchbay-nebius/agent audit <url-or-directory>No install: scan an MCP server in the browser and get a shareable report.
Disagree with this finding on your server? Open an issue with the --json output. False-positive reports are the most useful feedback.