Every claim cites a revision
Each requirement links to the section of the MCP Authorization revision it comes from. When the spec moves, the atlas says what changed and keeps the old reading intact.
An independent lab for agent auth
Authentication for agents, measured instead of asserted.
letsauth keeps one open dataset of what the agent protocols require and what real servers do. Every claim cites a specification revision, every status cites an observation, and the data is yours to download.
39public MCP servers listed
23requirements from MCP Authorization 2026-07-28
209observations on record, each with evidence
41specifications on the standards map, 67 relations between them
How the atlas works
Every status cites an observation
A cell is only ever a dated observation with a method and evidence a reviewer can open. Nothing is inferred from silence: an empty cell reads unknown, never failure.
Open, append-only data
The dataset is YAML in a public repository under CC BY 4.0. Observations are never edited, so the atlas is also a record of how the ecosystem moved.
The atlas
What it is, and what it refuses to be
The MCP Authorization specification tells servers how to advertise their authorization server, which registration methods to accept, how to validate tokens and how to challenge for scopes. The atlas is a matrix of public servers against those requirements. It is neutral: rows are alphabetical, nothing is scored, and an empty cell is shown as unknown, never as a failure.
The atlas contacts no server at build time. Seed data comes from vendor documentation and public directories, and says so on every cell. The scanner reads public metadata every night; its output lands in the same repository, as pull requests, like everything else.
And the standards behind it
The agent auth atlas draws the specifications behind all of this as one graph: OAuth and its extensions, workload identity, the agent protocols, credential formats and the EU acts, with what builds on what, what competes with what, and each document's maturity and dated revisions.
Latest observations
Newest entries on record
- SupportedAirtableDynamic Client Registration offered · Registration
- SupportedAirtableDocumented pre-registration path · Registration
- SupportedAirtablePKCE with S256 advertised · Authorization
- SupportedAirtableRefresh token rotation for public clients · Tokens
- UnsupportedAsanaDynamic Client Registration offered · Registration
- SupportedAsanaDocumented pre-registration path · Registration