Authorization server issues codes without PKCE
The /authorize endpoint issued an authorization code for a request that had no code_challenge.
What it means
OAuth 2.1 Section 7.5.1 requires PKCE on every authorization code flow. The MCP authorization spec revision 2026-07-28 inherits that. An authorization server that still issues codes without a code_challenge offers no protection against a stolen code: anyone who intercepts the authorization response can redeem it. The check is opt-in. patchbay registers a throw-away client via Dynamic Client Registration, then sends one /authorize request with a valid redirect and no code_challenge parameter. If the server responds with a redirect that carries an authorization code, the check fires critical. If the server rejects the request with an error parameter or a 4xx status, it passes silently.
How to fix
Reject any /authorize request that lacks a code_challenge parameter. Return a 302 redirect to the registered redirect_uri with error=invalid_request. Do not accept missing PKCE for confidential clients either. OAuth 2.1 removed that exception.
Spec
OAuth 2.1 Section 7.5.1See it live
Our demo MCP server trips PKCE-001 on purpose. Scan it and you'll see this exact finding with evidence and fix text.
npx -y @patchbay-nebius/agent audit https://demo.patchbay-mcp.dev/mcp --probe-headless-oauthThe --probe-headless-oauth flag is opt-in because it sends crafted authorize requests; safe against our demo, do not point it at production servers you don't own.
Run the check against your own server:
npx -y @patchbay-nebius/agent audit <url-or-directory>No install: scan an MCP server in the browser and get a shareable report.
Disagree with this finding on your server? Open an issue with the --json output. False-positive reports are the most useful feedback.