highRESOURCE-001

Protected Resource Metadata missing

The server uses OAuth but serves no usable /.well-known/oauth-protected-resource document.

What it means

Protected Resource Metadata (RFC 9728) is how a client finds out where to log in. The document names the authorization servers that issue tokens for this MCP server. The MCP authorization spec has required it since revision 2025-06-18 and still does in 2026-07-28. This finding has two shapes. Either the document is not served at all, or it is served without a non-empty "authorization_servers" list. In both cases a client that follows the spec cannot start the login without being configured by hand. The check only runs on servers that use OAuth, meaning the server required authentication or published authorization server metadata. A server that needs no login is not flagged here.

How to fix

Serve /.well-known/oauth-protected-resource as JSON. Include "authorization_servers" with at least one issuer URL, the same issuer you publish in your authorization server metadata. Set "resource" to the canonical URL of your MCP endpoint.

Spec

RFC 9728

Run the check against your own server:

npx -y @patchbay-nebius/agent audit <url-or-directory>

No install: scan an MCP server in the browser and get a shareable report.

Disagree with this finding on your server? Open an issue with the --json output. False-positive reports are the most useful feedback.