MCP authorization

A protected MCP endpoint's OAuth discovery chain: 401 → protected-resource metadata → authorization-server metadata (PKCE). (live probe)

✓ correct implementation ✗ broken implementation

Broken variant

Exercised on the authbroken host: the authorization-server metadata omits PKCE (code_challenge_methods_supported: S256). On the broken host mcpAuth is absent (the broken card can't advertise a discoverable endpoint).

Defect metrics

mcpAuthMissingResourceMetadata

mcpAuthMalformedResourceMetadata

mcpAuthResourceMismatch

mcpAuthMissingAuthorizationServer

mcpAuthInvalidAuthorizationServerUrl

mcpAuthMissingAuthorizationServerMetadata

mcpAuthMalformedAuthorizationServerMetadata

mcpAuthAuthorizationServerIssuerMismatch

mcpAuthMissingPkceSupport