- Is our MCP authentication working right now?
- Will anything break soon?
- If something is wrong, what changed?
Quickstart
Scan your first server in under a minute.
The problem
MCP authentication breaks quietly. A server returns401 with no WWW-Authenticate header, or its authorization server starts serving metadata whose issuer no longer matches the URL it was fetched from, or an identity provider stops emitting a field the specification requires. Uptime monitors report green. The customer’s agent just stops working.
Three forces make this routine rather than rare.
The authorization specification is churning
It did not exist in protocol revision2024-11-05 and has roughly tripled since:
2026-07-28 deprecates Dynamic Client Registration in favour of Client ID Metadata Documents, requires RFC 9207 issuer validation, binds client credentials to the issuer that minted them, and makes the protocol stateless.
Identity providers do not agree on the primitives
Auth0, Cognito and Okta ship no DCR by default — their metadata simply omitsregistration_endpoint. ChatGPT Connectors require DCR and reject static bearer tokens. OpenID Connect Discovery does not define code_challenge_methods_supported, yet the MCP spec makes clients refuse to proceed without it.
Clients diverge
The same server works in Cursor and fails in ChatGPT, with no server-side error to go on.What MCPComp does
Free scanner
Unauthenticated. Runs the discovery and client-compatibility checks and reports a graded verdict where every finding cites the requirement it violates.
Continuous monitoring
The same probes on a schedule, plus a diff engine over the metadata documents. Drift opens an issue before customers hit it.
Expiring credentials
The failure no probe can see from outside, read from inside the identity provider — with rotation built in.