Skip to main content
MCPComp points at an MCP server URL and answers three questions:
  1. Is our MCP authentication working right now?
  2. Will anything break soon?
  3. If something is wrong, what changed?
It does not replace Auth0, Entra, Okta or WorkOS. It sits above them and checks that the whole setup still works.

Quickstart

Scan your first server in under a minute.

​
The problem

MCP authentication breaks quietly. A server returns 401 with no WWW-Authenticate header, or its authorization server starts serving metadata whose issuer no longer matches the URL it was fetched from, or an identity provider stops emitting a field the specification requires. Uptime monitors report green. The customer’s agent just stops working. Three forces make this routine rather than rare.

​
The authorization specification is churning

It did not exist in protocol revision 2024-11-05 and has roughly tripled since: 2026-07-28 deprecates Dynamic Client Registration in favour of Client ID Metadata Documents, requires RFC 9207 issuer validation, binds client credentials to the issuer that minted them, and makes the protocol stateless.

​
Identity providers do not agree on the primitives

Auth0, Cognito and Okta ship no DCR by default — their metadata simply omits registration_endpoint. ChatGPT Connectors require DCR and reject static bearer tokens. OpenID Connect Discovery does not define code_challenge_methods_supported, yet the MCP spec makes clients refuse to proceed without it.

​
Clients diverge

The same server works in Cursor and fails in ChatGPT, with no server-side error to go on.

​
What MCPComp does

Free scanner

Unauthenticated. Runs the discovery and client-compatibility checks and reports a graded verdict where every finding cites the requirement it violates.

Continuous monitoring

Sign in at mcpcomp.dev and add a server, or run the same probes from your own repository. Drift alerts arrive by email and as a GitHub issue with a reviewable baseline PR. Free for one server; Pro monitors ten.

Expiring credentials

The failure no probe can see from outside, read from inside the identity provider — with rotation built in.