> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mcpcomp.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# What is MCPComp?

> A production reliability and control layer for authentication on MCP servers

MCPComp points at an MCP server URL and answers three questions:

1. **Is our MCP authentication working right now?**
2. **Will anything break soon?**
3. **If something is wrong, what changed?**

It does not replace Auth0, Entra, Okta or WorkOS. It sits above them and checks that the whole setup still works.

<Card title="Quickstart" icon="rocket" href="/quickstart">
  Scan your first server in under a minute.
</Card>

## The problem

MCP authentication breaks quietly. A server returns `401` with no `WWW-Authenticate` header, or its authorization server starts serving metadata whose `issuer` no longer matches the URL it was fetched from, or an identity provider stops emitting a field the specification requires. Uptime monitors report green. The customer's agent just stops working.

Three forces make this routine rather than rare.

### The authorization specification is churning

It did not exist in protocol revision `2024-11-05` and has roughly tripled since:

| Protocol version | Authorization spec     | Size    |
| ---------------- | ---------------------- | ------- |
| `2024-11-05`     | none                   | 0 lines |
| `2025-03-26`     | single document        | \~340   |
| `2025-06-18`     | single document        | 373     |
| `2025-11-25`     | single document        | 708     |
| `2026-07-28`     | split into 4 documents | 901     |

`2026-07-28` deprecates Dynamic Client Registration in favour of Client ID Metadata Documents, requires RFC 9207 issuer validation, binds client credentials to the issuer that minted them, and makes the protocol stateless.

### Identity providers do not agree on the primitives

Auth0, Cognito and Okta ship no DCR by default — their metadata simply omits `registration_endpoint`. ChatGPT Connectors *require* DCR and reject static bearer tokens. OpenID Connect Discovery does not define `code_challenge_methods_supported`, yet the MCP spec makes clients refuse to proceed without it.

### Clients diverge

The same server works in Cursor and fails in ChatGPT, with no server-side error to go on.

## What MCPComp does

<Card title="Free scanner" icon="magnifying-glass" href="/quickstart">
  Unauthenticated. Runs the discovery and client-compatibility checks and reports a graded verdict where every finding cites the requirement it violates.
</Card>

<Card title="Continuous monitoring" icon="chart-line" href="/monitoring">
  The same probes on a schedule, plus a diff engine over the metadata documents. Drift opens an issue before customers hit it.
</Card>

<Card title="Expiring credentials" icon="key" href="/entra">
  The failure no probe can see from outside, read from inside the identity provider — with rotation built in.
</Card>