An independent lab for agent authorization

Agent authorization, on the record

letsauth keeps one open dataset of what the agent protocols require and what public servers do. Each requirement cites a specification revision and each status cites a dated observation.

Open the MCP auth atlasDownload the data

MCP auth atlas 2026-07-28Open the matrix
39 servers × 23 requirements · last observation
Servers listed
39
Requirements in 2026-07-28
23
Observations on record
1662
Specifications mapped
41

The lab

What the lab publishes

  1. MCP auth atlas

    39 servers

    Public MCP servers against the requirements of MCP Authorization 2026-07-28, one dated observation per cell.

  2. Agent auth atlas

    41 specifications, 67 relations

    The specifications behind agent authorization as one graph, with what builds on what and the dated revisions of each.

  3. Delegation chain explorer

    3 scenarios, 11 toggles

    Delegation scenarios stepped hop by hop, with the decoded token at each step and toggles that break the chain.

  4. Breach anatomy

    5 entries

    Published vulnerabilities in how agents were authorized, each traced to the control that was missing.

  5. Scanner

    36 of 39 servers scanned

    A passive scanner that reads the public metadata of each listed server and records what it finds as observations.

Activity

Latest observations

  1. AirtableProtected Resource Metadata served · DiscoveryPassive scan
  2. AsanaProtected Resource Metadata served · DiscoveryPassive scan
  3. AtlassianProtected Resource Metadata served · DiscoveryPassive scan
  4. AttioProtected Resource Metadata served · DiscoveryPassive scan
  5. BoxProtected Resource Metadata served · DiscoveryPassive scan
  6. BuildkiteProtected Resource Metadata served · DiscoveryPassive scan

Seed data comes from vendor documentation and public directories, and each entry names its method. A cell with no observation on record reads unknown.

See the full matrix