MCP
OAuth 2.1
RFC 9728
RFC 8707
authorization
confused deputy

MCP OAuth 2.1 Authorization Auditor

Validates an MCP protected-resource-metadata (RFC 9728) document, visualizes the OAuth 2.1 discovery chain, checks RFC 8707 resource-indicator / audience binding, and self-assesses token-passthrough and confused-deputy risk. Reference rules are static and may age — verify against the live MCP authorization spec.

Tool URL: https://ainumbers.co/tools/278-mcp-oauth-authorization-auditor.html AP2/Policy Mandate export: yes

post/v1/tools/audit_mcp_oauth

Request

  • Base URL: https://ainumbers.co
  • URL: https://ainumbers.co/v1/tools/audit_mcp_oauth
  • Auth: none declared

Request body

protected_resource_metadataobject

The /.well-known/oauth-protected-resource JSON.

canonical_resourcestring

Canonical MCP server resource URI.

Response

Successful tool execution result

scorenumber

Changes

No recorded changes to this operation across all 1 revision of this API.