Free MCP OAuth Checker: Test a Remote MCP Server's Auth

What it checks:

• The challenge. An unauthenticated initialize must get 401 with WWW-Authenticate: Bearer resource_metadata="...", scope="...", not a 200, a login redirect or a 500.
• Protected Resource Metadata (RFC 9728). Found at the challenge URL or the path-inserted / root well-known URLs; resource must equal the server URL exactly (clients reject a mismatch, a very common bug behind proxies); authorization_servers present.
• Authorization server discovery, in the order clients use (RFC 8414 then OpenID, path-aware): issuer match, endpoints, HTTPS, code_challenge_methods_supported with S256 (without it MCP clients stop), and which registration options exist (Client ID Metadata Documents, DCR, or pre-registration only).

python3 tools/mcp_oauth_check.py https://mcp.example.com/mcp
python3 tools/mcp_oauth_check.py https://mcp.example.com/mcp --token "$ACCESS_TOKEN"   # also test token handling
python3 tools/mcp_oauth_check.py https://mcp.example.com/mcp --flow                    # full OAuth flow in your browser
python3 tools/mcp_oauth_check.py https://mcp.example.com/mcp --json                    # for CI (exit 1 on errors)

Try it locally: bash tools/demo.sh (a clean mock and a broken server) and bash run_tests.sh (7 tests).

Try it locally: bash tools/demo.sh (a clean mock and a broken server) and bash run_tests.sh (7 tests). Tested from a fresh Estage CDN download on Python 3.13 and 3.10: both exited 0.

Limits: a clean run is evidence, not a security audit. The token tests only send requests a correct server rejects. --flow needs DCR or a --client-id your authorization server knows.