---
title: "MCP OAuth 2.1 Authorization Auditor"
method: POST
path: "/v1/tools/audit_mcp_oauth"
tags: ["MCP", "OAuth 2.1", "RFC 9728", "RFC 8707", "authorization", "confused deputy"]
---

# MCP OAuth 2.1 Authorization Auditor

`POST /v1/tools/audit_mcp_oauth`

## Request

- Base URL: `https://ainumbers.co`
- URL: `https://ainumbers.co/v1/tools/audit_mcp_oauth`
- Auth: none declared

Validates an MCP protected-resource-metadata (RFC 9728) document, visualizes the OAuth 2.1 discovery chain, checks RFC 8707 resource-indicator / audience binding, and self-assesses token-passthrough and confused-deputy risk. Reference rules are static and may age — verify against the live MCP authorization spec.

**Tool URL:** https://ainumbers.co/tools/278-mcp-oauth-authorization-auditor.html
**AP2/Policy Mandate export:** yes

## Request body

- object
  - `protected_resource_metadata` object: The /.well-known/oauth-protected-resource JSON.
  - `canonical_resource` string: Canonical MCP server resource URI.

## Response `200`

Successful tool execution result

- object
  - `score` number
  - `findings` unknown[]
    - unknown

---

[API](https://skmtc.dev/ainumbers/apis/ainumbers-co-fintech-intelligence-suite.md) · [All operations](https://skmtc.dev/ainumbers/apis/ainumbers-co-fintech-intelligence-suite/llms.txt) · [OpenAPI document](https://skmtc.dev/ainumbers/apis/ainumbers-co-fintech-intelligence-suite/revisions/b462e4f5bb28?raw)