MCP authorization broken variant
A protected MCP endpoint's OAuth discovery chain: 401 → protected-resource metadata → authorization-server metadata (PKCE).
Live probe — one per host.
This signal isn't a page; the container probes it at a fixed path, and the
correct/broken/authbroken variant is chosen by the request host. On this host the canonical path(s)
below serve the broken variant. Add
?mode=… to override locally.
Canonical path(s)
Broken variant
Exercised on the authbroken host: the authorization-server metadata omits PKCE (code_challenge_methods_supported: S256). On the broken host mcpAuth is absent (the broken card can't advertise a discoverable endpoint).
Defect metrics
| Defect boolean |
|---|
mcpAuthMissingResourceMetadata |
mcpAuthMalformedResourceMetadata |
mcpAuthResourceMismatch |
mcpAuthMissingAuthorizationServer |
mcpAuthInvalidAuthorizationServerUrl |
mcpAuthMissingAuthorizationServerMetadata |
mcpAuthMalformedAuthorizationServerMetadata |
mcpAuthAuthorizationServerIssuerMismatch |
mcpAuthMissingPkceSupport |
Fetch the live file: https://agentic-correct.crawler-test.com/mcp-protected