---
title: "Least-privilege auth audit of an MCP server (?url=), read without signing in: the 401 challenge, protected-resource metadata (RFC 9728) and authorization-server metadata (RFC 8414); the scopes a client requests by default, write or admin scopes requested when read-only ones exist, token audience against the endpoint, PKCE S256. Signed (crawlcheck-mcp-auth)"
method: GET
path: "/api/v1/mcp/auth"
---

# Least-privilege auth audit of an MCP server (?url=), read without signing in: the 401 challenge, protected-resource metadata (RFC 9728) and authorization-server metadata (RFC 8414); the scopes a client requests by default, write or admin scopes requested when read-only ones exist, token audience against the endpoint, PKCE S256. Signed (crawlcheck-mcp-auth)

`GET /api/v1/mcp/auth`

## Request

- Base URL: `https://crawlcheck.io`
- URL: `https://crawlcheck.io/api/v1/mcp/auth`
- Auth: none required

## Query parameters

- `url` string, required

## Response `200`

crawlcheck-mcp-auth

- object, nullable
  - `kind` string, nullable
  - `v` number, nullable
  - `audited_at` string, nullable
  - `url` string, nullable
  - `outcome` string, nullable
  - `status` number, nullable
  - `challenge` object, nullable
    - `header` string, nullable
    - `scheme` string, nullable
    - `scope` unknown
    - `resource_metadata` string, nullable
    - `error` unknown
  - `protected_resource` object, nullable
    - `url` string, nullable
    - `resource` string, nullable
    - `authorization_servers` string[], nullable
    - `scopes_supported` string[], nullable
    - `bearer_methods_supported` string[], nullable
  - `authorization_server` object, nullable
    - `url` string, nullable
    - `issuer` string, nullable
    - `code_challenge_methods_supported` string[], nullable
    - `registration_endpoint` boolean, nullable
    - `scopes_supported_count` number, nullable
    - `grant_types_supported` string[], nullable
  - `requested` object, nullable
    - `source` string, nullable
    - `scopes` string[], nullable
    - `count` number, nullable
    - `by_class` object, nullable
      - `read` string[], nullable
      - `write` string[], nullable
    - `read_only_offered` string[], nullable
    - `reading` string, nullable
  - `findings` object[], nullable
    - `code` string, nullable
    - `severity` string, nullable
    - `evidence` object, nullable
      - `requested` string[], nullable
      - `write_or_admin` string[], nullable
      - `read_only_offered` string[], nullable
    - `reading` string, nullable
  - `unmeasured` string[], nullable
  - `severity` string, nullable
  - `reading` unknown
  - `method` string, nullable
  - `sha256` unknown
  - `signature` unknown

---

[API](https://skmtc.dev/crawlcheck/apis/crawlcheck-api.md) · [All operations](https://skmtc.dev/crawlcheck/apis/crawlcheck-api/llms.txt) · [OpenAPI document](https://skmtc.dev/crawlcheck/apis/crawlcheck-api/revisions/57acbd6d4489?raw)