MundoKit

MCP OAuth metadata checker

Paste the three public metadata documents and their expected identifiers. Inspect exact-match failures and missing authorization-code capabilities without authenticating.

Offline metadata preflight for HTTP MCP and Client ID Metadata Documents.

How it works

The checker parses each document separately, checks field shapes and compares identifiers exactly. Resource identifiers require HTTPS under RFC 9728. Omitted client and server authentication methods default to client_secret_basic; public CIMD clients must explicitly select none and the server must support it. private_key_jwt requires one public-key source: an HTTPS jwks_uri or an inline RSA/EC signing JWK set. Remote retrieval, cryptographic validity and algorithm acceptance remain unverified. It checks the authorization-code flow and advertised S256 support. The client profile is CIMD; pre-registered client identifiers require a different registration workflow.

Findings identify document fields. Counts are exact integers with no rounding. Use only public metadata; no credentials are needed.

Worked examples

Matching example documents

The initial example uses resource https://mcp.example.com/mcp and issuer https://auth.example.com. Its matching public client document, explicit none authentication on both sides and S256 advertisement yield 0 findings.

Missing PKCE advertisement

Remove code_challenge_methods_supported from the initial authorization-server document. All other values unchanged, the result has 1 error.

What a clean report means

The covered document checks found no mismatches. This is not a full RFC validator or security audit. An authorization server can still reject a client under its trust policy. Scope arrays are type-checked, but consent and challenge-driven scope selection require live protocol evidence.

Frequently asked questions

Does this test a login?
No. It makes no requests and cannot verify TLS, endpoint behavior, token audiences, redirects or actual PKCE enforcement.
Why does a trailing slash cause a mismatch?
The expected identifiers are compared exactly. The checker deliberately avoids URL normalization that could conceal different resources.
Which protocol version is covered?
The explicit profile is MCP 2025-11-25 for HTTP authorization and Client ID Metadata Documents. STDIO credentials are outside scope.
What if CIMD support is not advertised?
The report asks for registration review. A client may need pre-registration or supported dynamic registration instead.
Are loopback redirects rejected?
HTTP loopback redirects are accepted by this checker. Other redirect hosts require HTTPS; fragments are rejected.

Sources

Last reviewed 2026-11-14; next review due by 2026-12-14. The method is written out above so you can check our math.