Check families
The report also names the capabilities it observed — PKCE, registration
(DCR/CIMD), RFC 9207
iss, and the machine-to-machine grants
(client_credentials and jwt-bearer workload identity) — the facts a
developer maps onto a client’s requirements. The baseline diff watches these
too: a resource flipping dpop_bound_access_tokens_required locks out every
non-DPoP client with no other metadata change.
Probe tiers
Checks are tagged by how much access they need:passive— no credentials. Mostly read from metadata documents; also includes credential-less liveness requests to the endpoints that metadata advertises — an unauthenticated GET is what any client emits before it has anything. On a server offering Dynamic Client Registration, the authorization endpoint’s liveness GET carries the query a client with a stale registration would send (a synthetic client id that cannot exist, plus a PKCE challenge), because the answer identifies the server framework and costs no extra request. Nothing is registered and no token is presented.active— presents tokens, registers clients, and otherwise attempts the attacks it is checking for. Not implemented yet; when it lands it will not run without proof the operator owns the target.
Multiple authorization servers
The client-compatibility checks run againstauthorization_servers[0] — the entry the MCP SDK selects unconditionally, so its verdict is what a reference client experiences. The others are checked for metadata resolution and issuer identity only: the specification makes each listed server independent and leaves the choice among them to the client, so one that does not resolve is broken for whichever client picks it. At most five beyond the first are probed; if the cap bites, the check reports as skipped rather than passed, because it did not see what it claims to cover.
Verdicts a check can reach
Every check ends in exactly one of three states:- Passed — the thing was observed and conforms.
- Finding — the thing was observed and does not.
- Skipped — the thing was never observed, so neither claim is honest. A check never reports “passed” for something it did not see.