---
title: "MCP Authorization Metadata Validator (RFC 9728)"
method: POST
path: "/v1/tools/validate_mcp_authorization_metadata"
tags: ["TODO_TAGS_REVIEW"]
---

# MCP Authorization Metadata Validator (RFC 9728)

`POST /v1/tools/validate_mcp_authorization_metadata`

## Request

- Base URL: `https://ainumbers.co`
- URL: `https://ainumbers.co/v1/tools/validate_mcp_authorization_metadata`
- Auth: none declared

Validate OAuth 2.0 Protected Resource Metadata per RFC 9728: resource URI (https-scheme), non-empty authorization_servers, scopes_supported, and bearer_methods_supported restricted to header/body/query. Flags each missing or malformed member. Consumes server identity verdict (art-147), feeds registry entry conformance check (art-149). Zero network, zero PII.

**Tool URL:** https://ainumbers.co/chaingraph/art-148-mcp-authorization-metadata-validator.html
**AP2/Policy Mandate export:** yes

## Request body

- object
  - `metadata` unknown

## Response `200`

Successful tool execution result

- object
  - `auth_server_count` integer
  - `bearer_ok` boolean
  - `metadata_valid` boolean
  - `missing` unknown[]
    - unknown
  - `resource_ok` boolean
  - `scope_count` integer

---

[API](https://skmtc.dev/ainumbers/apis/ainumbers-co-fintech-intelligence-suite.md) · [All operations](https://skmtc.dev/ainumbers/apis/ainumbers-co-fintech-intelligence-suite/llms.txt) · [OpenAPI document](https://skmtc.dev/ainumbers/apis/ainumbers-co-fintech-intelligence-suite/revisions/b462e4f5bb28?raw)