MCP OAuth checklist

Publish Protected Resource Metadata

The document under /.well-known/oauth-protected-resource names your resource identifier and the authorization servers that issue tokens for it. Clients use it to find where to log in.

Source:

MCP spec, RFC 9728

Test:

Browser scan and CLI

RESOURCE-001: what it means and how to fix it

List S256 in code_challenge_methods_supported

Clients have to verify PKCE support from the authorization server metadata. If the field is absent they must stop before the login.

Source:

MCP spec 2026-07-28

Test:

Browser scan and CLI

AUTH-003: what it means and how to fix it·Full write-up

Offer an automatic way to register

Support Client ID Metadata Documents, which the current spec recommends, or keep a Dynamic Client Registration endpoint for older clients. With neither, every client has to be added by hand.

Source:

MCP spec 2026-07-28

Test:

Browser scan and CLI

AUTH-005: what it means and how to fix it·Full write-up

Accept loopback redirect URIs with any port

CLI and desktop clients listen on a local port that changes on every login. An authorization server that insists on an exact port breaks all of them.

Source:

RFC 8252 §7.3

Test:

CLI with flag--probe-dcr-loopback

AUTH-006: what it means and how to fix it·Full write-up

Treat localhost and 127.0.0.1 the same

Clients use both forms. Accepting one and rejecting the other locks out every client that uses the other form.

Source:

Good practice

Test:

Browser scan and CLI

REDIRECT-001: what it means and how to fix it

Validate the audience of every token

A token issued for another service behind the same authorization server must not work on your MCP server. Compare the aud claim with your own resource identifier and reject everything else.

Source:

MCP spec, RFC 8707 §2

Test:

CLI with flag--probe-audience=<token>

AUDIENCE-001: what it means and how to fix it·Full write-up

Accept the resource parameter

MCP clients send it on authorization and token requests so the authorization server can bind the token to your server. Make sure yours does not reject or ignore it.

Source:

MCP spec, RFC 8707

Test:

Check by hand

Do not rely on a static key alone

A long lived bearer token or API key with no OAuth discovery cannot be scoped, rotated per client or bound to an audience.

Source:

Good practice

Test:

Browser scan and CLI

AUTH-002: what it means and how to fix it

Never expose write tools without authentication

A public server for read only lookups can be a deliberate choice. A server that answers tools/list without credentials and offers tools that create, send or delete is open to anyone who finds the URL.

Source:

Good practice

Test:

Browser scan and CLI

AUTH-001: what it means and how to fix it

Serve over HTTPS only

Tokens and tool calls over plain HTTP can be read and changed in transit.

Source:

Good practice

Test:

Browser scan and CLI

TRANSPORT-001: what it means and how to fix it

Reject requests from origins you do not expect

This matters when browsers can reach the server. Without an origin check a web page the user visits can talk to it.

Source:

Good practice

Test:

Browser scan and CLI

TRANSPORT-002: what it means and how to fix it

Give tools their own scopes

With one scope for everything, a client that only needs to read gets permission to write as well.

Source:

Good practice

Test:

Browser scan and CLI

SCOPE-001: what it means and how to fix it

Separate read and write

Read and write tools behind the same scope cannot be granted independently.

Source:

Good practice

Test:

Browser scan and CLI

SCOPE-002: what it means and how to fix it

No secrets in source

Keys committed to the repository end up in every clone and every fork.

Source:

Good practice

Test:

CLI

SECRET-001: what it means and how to fix it

Give long lived credentials a refresh path

A credential that sits in an environment variable forever cannot be rotated without downtime.

Source:

Good practice

Test:

CLI

SECRET-002: what it means and how to fix it

Watch your tool list for changes

Nothing in the spec makes a client ask the user again when a tool is added or its description changes. Pin the manifest and review every difference.

Source:

Good practice

Test:

CLI

MANIFEST-001: what it means and how to fix it·Full write-up