🔐 OAuth 2.1 Debugger

Validate the complete OAuth 2.1 setup of any remote MCP endpoint — the same checks real MCP clients perform.

Reference — the OAuth 2.1 handshake MCP clients expect

  1. 401 challenge. POST /mcp initialize without a token → HTTP 401 with WWW-Authenticate: Bearer resource_metadata="…".
  2. RFC 9728 protected-resource metadata at /.well-known/oauth-protected-resource (path-aware variants allowed):
    {
  "resource": "https://mcp.example.com/mcp",
  "authorization_servers": ["https://auth.example.com"],
  "scopes_supported": ["read"],
  "bearer_methods_supported": ["header"]
}
  3. RFC 8414 authorization-server metadata at /.well-known/oauth-authorization-server (or OIDC discovery), with authorization_endpoint, token_endpoint, registration_endpoint (DCR, RFC 7591) and code_challenge_methods_supported: ["S256"].
  4. PKCE S256 + DCR — the client registers itself dynamically and completes the code flow with an S256 challenge.
  5. CORS — browsers need Access-Control-Allow-Origin, allow headers Content-Type, Authorization, Mcp-Session-Id, and expose Mcp-Session-Id + WWW-Authenticate.