{
  "version": 1,
  "generatedAt": "2026-10-14T13:29:39.359Z",
  "license": "CC BY 4.0",
  "source": "https://letsauth.eu/atlas/mcp/servers/intercom/",
  "spec": {
    "id": "mcp-authorization",
    "name": "MCP Authorization",
    "currentRevision": "2026-07-28",
    "revisions": [
      {
        "id": "2025-11-25",
        "date": "2025-11-25",
        "status": "superseded",
        "url": "https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization",
        "changes": "Makes OAuth Client ID Metadata Documents the recommended client registration method and adds Enterprise-Managed Authorization (ID-JAG) as an extension.\n"
      },
      {
        "id": "2026-07-28",
        "date": "2026-07-28",
        "status": "current",
        "url": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
        "supersedes": "2025-11-25",
        "changes": "Deprecates Dynamic Client Registration in favour of Client ID Metadata Documents, requires RFC 9207 issuer validation on authorization responses, keys stored client credentials by issuer, requires application_type on DCR requests, and removes session identifiers from the transport. Splits the authorization text into separate pages for discovery, client registration and security considerations.\n"
      }
    ]
  },
  "server": {
    "id": "intercom",
    "name": "Intercom",
    "url": "https://mcp.intercom.com/sse",
    "homepage": "https://intercom.com",
    "transport": "sse",
    "listed": "public-directory",
    "source": "https://github.com/jaw9c/awesome-remote-mcp-servers",
    "authClaimed": "oauth2.1"
  },
  "features": [
    {
      "id": "mcp.as.cimd",
      "name": "Client ID Metadata Documents supported",
      "description": "The authorization server accepts an HTTPS URL as client_id and fetches the client's metadata document, advertising client_id_metadata_document_supported: true.\n",
      "category": "registration",
      "party": "authorization-server",
      "observable": "passive",
      "revisions": [
        {
          "spec": "mcp-authorization",
          "revision": "2025-11-25",
          "section": "Client ID Metadata Documents",
          "level": "SHOULD",
          "levelNote": "Became the recommended registration method in this revision."
        },
        {
          "spec": "mcp-authorization",
          "revision": "2026-07-28",
          "section": "Client Registration › Client ID Metadata Documents",
          "level": "SHOULD"
        }
      ]
    },
    {
      "id": "mcp.as.dcr",
      "name": "Dynamic Client Registration offered",
      "description": "The authorization server exposes a registration_endpoint (RFC 7591) so clients can register themselves at runtime.\n",
      "category": "registration",
      "party": "authorization-server",
      "observable": "passive",
      "revisions": [
        {
          "spec": "mcp-authorization",
          "revision": "2025-11-25",
          "section": "Dynamic Client Registration",
          "level": "SHOULD"
        },
        {
          "spec": "mcp-authorization",
          "revision": "2026-07-28",
          "section": "Client Registration › Dynamic Client Registration",
          "level": "MAY",
          "levelNote": "Deprecated; retained for compatibility with clients that cannot use Client ID Metadata Documents."
        }
      ]
    },
    {
      "id": "mcp.as.https",
      "name": "All endpoints served over HTTPS",
      "description": "Every authorization server endpoint listed in its metadata uses HTTPS.\n",
      "category": "transport",
      "party": "authorization-server",
      "observable": "passive",
      "revisions": [
        {
          "spec": "mcp-authorization",
          "revision": "2025-11-25",
          "section": "Security Considerations › Communication Security",
          "level": "MUST"
        },
        {
          "spec": "mcp-authorization",
          "revision": "2026-07-28",
          "section": "Security Considerations › Communication Security",
          "level": "MUST"
        }
      ]
    },
    {
      "id": "mcp.as.iss-param",
      "name": "Issuer identifier in authorization responses",
      "description": "The authorization server returns the iss parameter on authorization responses (RFC 9207) and advertises authorization_response_iss_parameter_supported: true.\n",
      "category": "authorization",
      "party": "authorization-server",
      "observable": "passive",
      "revisions": [
        {
          "spec": "mcp-authorization",
          "revision": "2026-07-28",
          "section": "Authorization › Authorization Response Validation",
          "level": "SHOULD"
        }
      ]
    },
    {
      "id": "mcp.as.issuer-match",
      "name": "Metadata issuer matches the discovery URL",
      "description": "The issuer value inside the metadata document equals the issuer identifier used to construct the well-known URL, so clients can detect a substituted document.\n",
      "category": "discovery",
      "party": "authorization-server",
      "observable": "passive",
      "revisions": [
        {
          "spec": "mcp-authorization",
          "revision": "2025-11-25",
          "section": "Authorization Server Discovery › Authorization Server Metadata Discovery",
          "level": "MUST"
        },
        {
          "spec": "mcp-authorization",
          "revision": "2026-07-28",
          "section": "Authorization Server Discovery › Authorization Server Metadata Discovery",
          "level": "MUST"
        }
      ]
    },
    {
      "id": "mcp.as.metadata",
      "name": "Authorization server metadata discoverable",
      "description": "The authorization server publishes metadata via OAuth 2.0 Authorization Server Metadata (RFC 8414) or OpenID Connect Discovery.\n",
      "category": "discovery",
      "party": "authorization-server",
      "observable": "passive",
      "revisions": [
        {
          "spec": "mcp-authorization",
          "revision": "2025-11-25",
          "section": "Authorization Server Discovery › Authorization Server Metadata Discovery",
          "level": "MUST"
        },
        {
          "spec": "mcp-authorization",
          "revision": "2026-07-28",
          "section": "Authorization Server Discovery › Authorization Server Metadata Discovery",
          "level": "MUST"
        }
      ]
    },
    {
      "id": "mcp.as.pkce-s256",
      "name": "PKCE with S256 advertised",
      "description": "The metadata lists code_challenge_methods_supported including S256, which MCP clients require before they will start an authorization flow.\n",
      "category": "authorization",
      "party": "authorization-server",
      "observable": "passive",
      "revisions": [
        {
          "spec": "mcp-authorization",
          "revision": "2025-11-25",
          "section": "Security Considerations › Authorization Code Protection",
          "level": "MUST"
        },
        {
          "spec": "mcp-authorization",
          "revision": "2026-07-28",
          "section": "Security Considerations › Authorization Code Protection",
          "level": "MUST"
        }
      ]
    },
    {
      "id": "mcp.as.preregistration",
      "name": "Documented pre-registration path",
      "description": "The provider documents how a client developer obtains pre-registered client credentials when neither CIMD nor DCR is available.\n",
      "category": "registration",
      "party": "authorization-server",
      "observable": "manual",
      "revisions": [
        {
          "spec": "mcp-authorization",
          "revision": "2025-11-25",
          "section": "Authorization Server Discovery › Dynamic Client Registration",
          "level": "SHOULD",
          "levelNote": "Pre-registration was the fallback when DCR was unavailable."
        },
        {
          "spec": "mcp-authorization",
          "revision": "2026-07-28",
          "section": "Client Registration › Pre-registration",
          "level": "SHOULD",
          "levelNote": "Required as a fallback for clients that cannot register dynamically."
        }
      ]
    },
    {
      "id": "mcp.as.refresh-rotation",
      "name": "Refresh token rotation for public clients",
      "description": "Refresh tokens issued to public clients are rotated or sender-constrained as OAuth 2.1 requires.\n",
      "category": "token",
      "party": "authorization-server",
      "observable": "manual",
      "revisions": [
        {
          "spec": "mcp-authorization",
          "revision": "2025-11-25",
          "section": "Security Considerations › Token Theft",
          "level": "MUST"
        },
        {
          "spec": "mcp-authorization",
          "revision": "2026-07-28",
          "section": "Security Considerations › Token Theft",
          "level": "MUST"
        }
      ]
    },
    {
      "id": "mcp.as.resource-indicator",
      "name": "Resource indicators honoured",
      "description": "The authorization server accepts the RFC 8707 resource parameter and binds the audience of issued tokens to the requested MCP server.\n",
      "category": "token",
      "party": "authorization-server",
      "observable": "manual",
      "revisions": [
        {
          "spec": "mcp-authorization",
          "revision": "2025-11-25",
          "section": "Security Considerations › Token Audience Binding and Validation",
          "level": "MUST",
          "levelNote": "Required for the audience binding that the MCP server must enforce."
        },
        {
          "spec": "mcp-authorization",
          "revision": "2026-07-28",
          "section": "Security Considerations › Token Audience Binding and Validation",
          "level": "MUST",
          "levelNote": "Required for the audience binding that the MCP server must enforce."
        }
      ]
    },
    {
      "id": "mcp.prm.authorization-servers",
      "name": "PRM lists an authorization server",
      "description": "The authorization_servers field of the PRM document names at least one authorization server issuer.\n",
      "category": "discovery",
      "party": "mcp-server",
      "observable": "passive",
      "revisions": [
        {
          "spec": "mcp-authorization",
          "revision": "2025-11-25",
          "section": "Authorization Server Discovery › Authorization Server Location",
          "level": "MUST"
        },
        {
          "spec": "mcp-authorization",
          "revision": "2026-07-28",
          "section": "Authorization Server Discovery › Authorization Server Location",
          "level": "MUST"
        }
      ]
    },
    {
      "id": "mcp.prm.no-offline-access",
      "name": "No offline_access in advertised scopes",
      "description": "The server does not advertise or request the offline_access scope; refresh-token issuance is left to the authorization server's own policy.\n",
      "category": "token",
      "party": "mcp-server",
      "observable": "passive",
      "revisions": [
        {
          "spec": "mcp-authorization",
          "revision": "2026-07-28",
          "section": "Authorization › Refresh Tokens",
          "level": "SHOULD"
        }
      ]
    },
    {
      "id": "mcp.prm.scopes-supported",
      "name": "PRM lists scopes_supported",
      "description": "The PRM document advertises the scopes the server understands, so a client can choose an initial scope set before the first request.\n",
      "category": "discovery",
      "party": "mcp-server",
      "observable": "passive",
      "revisions": [
        {
          "spec": "mcp-authorization",
          "revision": "2025-11-25",
          "section": "Authorization Flow › Scope Selection Strategy",
          "level": "MAY"
        },
        {
          "spec": "mcp-authorization",
          "revision": "2026-07-28",
          "section": "Authorization › Scope Selection Strategy",
          "level": "MAY"
        }
      ]
    },
    {
      "id": "mcp.prm.well-known",
      "name": "PRM reachable at a well-known URI",
      "description": "The metadata document is served at the path-aware or root well-known location derived from the MCP server URL, so a client can find it without a prior 401.\n",
      "category": "discovery",
      "party": "mcp-server",
      "observable": "passive",
      "revisions": [
        {
          "spec": "mcp-authorization",
          "revision": "2025-11-25",
          "section": "Authorization Server Discovery › Protected Resource Metadata Discovery Requirements",
          "level": "MUST",
          "levelNote": "One of two discovery mechanisms the server must offer."
        },
        {
          "spec": "mcp-authorization",
          "revision": "2026-07-28",
          "section": "Authorization Server Discovery › Protected Resource Metadata Discovery Requirements",
          "level": "MUST",
          "levelNote": "One of two discovery mechanisms the server must offer."
        }
      ]
    },
    {
      "id": "mcp.prm.www-authenticate",
      "name": "resource_metadata in the 401 challenge",
      "description": "An unauthenticated request receives a 401 whose WWW-Authenticate header carries a resource_metadata parameter pointing at the PRM document.\n",
      "category": "discovery",
      "party": "mcp-server",
      "observable": "active",
      "revisions": [
        {
          "spec": "mcp-authorization",
          "revision": "2025-11-25",
          "section": "Authorization Server Discovery › Protected Resource Metadata Discovery Requirements",
          "level": "MUST",
          "levelNote": "One of two discovery mechanisms the server must offer."
        },
        {
          "spec": "mcp-authorization",
          "revision": "2026-07-28",
          "section": "Authorization Server Discovery › Protected Resource Metadata Discovery Requirements",
          "level": "MUST",
          "levelNote": "One of two discovery mechanisms the server must offer."
        }
      ]
    },
    {
      "id": "mcp.prm",
      "name": "Protected Resource Metadata served",
      "description": "The MCP server publishes an OAuth 2.0 Protected Resource Metadata document (RFC 9728) that tells clients which authorization servers protect it.\n",
      "category": "discovery",
      "party": "mcp-server",
      "observable": "passive",
      "revisions": [
        {
          "spec": "mcp-authorization",
          "revision": "2025-11-25",
          "section": "Authorization Server Discovery › Authorization Server Location",
          "level": "MUST"
        },
        {
          "spec": "mcp-authorization",
          "revision": "2026-07-28",
          "section": "Authorization Server Discovery › Authorization Server Location",
          "level": "MUST"
        }
      ]
    },
    {
      "id": "mcp.proxy.consent",
      "name": "Per-client consent on proxy servers",
      "description": "An MCP server that acts as a proxy with a static upstream client id obtains the user's consent for each dynamically registered client before forwarding.\n",
      "category": "consent",
      "party": "mcp-server",
      "observable": "manual",
      "revisions": [
        {
          "spec": "mcp-authorization",
          "revision": "2025-11-25",
          "section": "Security Considerations › Confused Deputy Problem",
          "level": "MUST"
        },
        {
          "spec": "mcp-authorization",
          "revision": "2026-07-28",
          "section": "Security Considerations › Confused Deputy Problem",
          "level": "MUST"
        }
      ]
    },
    {
      "id": "mcp.rs.401-on-invalid",
      "name": "401 for missing or invalid tokens",
      "description": "Requests without a token, or with an invalid or expired one, receive HTTP 401 Unauthorized.\n",
      "category": "token",
      "party": "mcp-server",
      "observable": "active",
      "revisions": [
        {
          "spec": "mcp-authorization",
          "revision": "2025-11-25",
          "section": "Access Token Usage › Token Handling",
          "level": "MUST"
        },
        {
          "spec": "mcp-authorization",
          "revision": "2026-07-28",
          "section": "Authorization › Token Handling",
          "level": "MUST"
        }
      ]
    },
    {
      "id": "mcp.rs.audience-validation",
      "name": "Audience validation",
      "description": "The MCP server rejects tokens that were not issued for it, so a token obtained for another resource cannot be replayed against this server.\n",
      "category": "token",
      "party": "mcp-server",
      "observable": "active",
      "revisions": [
        {
          "spec": "mcp-authorization",
          "revision": "2025-11-25",
          "section": "Security Considerations › Access Token Privilege Restriction",
          "level": "MUST"
        },
        {
          "spec": "mcp-authorization",
          "revision": "2026-07-28",
          "section": "Security Considerations › Access Token Privilege Restriction",
          "level": "MUST"
        }
      ]
    },
    {
      "id": "mcp.rs.bearer-header",
      "name": "Bearer token only in the Authorization header",
      "description": "The MCP server accepts access tokens only in the Authorization: Bearer header and rejects tokens passed in the query string.\n",
      "category": "token",
      "party": "mcp-server",
      "observable": "active",
      "revisions": [
        {
          "spec": "mcp-authorization",
          "revision": "2025-11-25",
          "section": "Access Token Usage › Token Requirements",
          "level": "MUST"
        },
        {
          "spec": "mcp-authorization",
          "revision": "2026-07-28",
          "section": "Authorization › Access Token Usage",
          "level": "MUST"
        }
      ]
    },
    {
      "id": "mcp.rs.insufficient-scope",
      "name": "403 insufficient_scope for step-up",
      "description": "When a valid token lacks a required scope the server answers 403 with error=\"insufficient_scope\" and the scopes needed, enabling step-up authorization.\n",
      "category": "authorization",
      "party": "mcp-server",
      "observable": "active",
      "revisions": [
        {
          "spec": "mcp-authorization",
          "revision": "2025-11-25",
          "section": "Authorization Flow › Scope Challenge Handling",
          "level": "SHOULD"
        },
        {
          "spec": "mcp-authorization",
          "revision": "2026-07-28",
          "section": "Authorization › Scope Challenge Handling",
          "level": "SHOULD"
        }
      ]
    },
    {
      "id": "mcp.rs.no-passthrough",
      "name": "No token passthrough to upstream APIs",
      "description": "The MCP server never forwards the client's access token to upstream APIs; it obtains its own credentials for downstream calls.\n",
      "category": "delegation",
      "party": "mcp-server",
      "observable": "manual",
      "revisions": [
        {
          "spec": "mcp-authorization",
          "revision": "2025-11-25",
          "section": "Security Considerations › Access Token Privilege Restriction",
          "level": "MUST"
        },
        {
          "spec": "mcp-authorization",
          "revision": "2026-07-28",
          "section": "Security Considerations › Access Token Privilege Restriction",
          "level": "MUST"
        }
      ]
    },
    {
      "id": "mcp.rs.scope-challenge",
      "name": "Scope in the WWW-Authenticate challenge",
      "description": "The 401 challenge includes a scope parameter naming the scopes a client should request.\n",
      "category": "authorization",
      "party": "mcp-server",
      "observable": "active",
      "revisions": [
        {
          "spec": "mcp-authorization",
          "revision": "2025-11-25",
          "section": "Authorization Flow › Scope Selection Strategy",
          "level": "SHOULD"
        },
        {
          "spec": "mcp-authorization",
          "revision": "2026-07-28",
          "section": "Authorization › Scope Selection Strategy",
          "level": "SHOULD"
        }
      ]
    }
  ],
  "cells": [
    {
      "server": "intercom",
      "feature": "mcp.as.issuer-match",
      "revision": "2025-11-25",
      "status": "unknown",
      "derived": true
    },
    {
      "server": "intercom",
      "feature": "mcp.as.metadata",
      "revision": "2025-11-25",
      "status": "unknown",
      "derived": true
    },
    {
      "server": "intercom",
      "feature": "mcp.prm",
      "revision": "2025-11-25",
      "status": "unknown",
      "derived": true
    },
    {
      "server": "intercom",
      "feature": "mcp.prm.authorization-servers",
      "revision": "2025-11-25",
      "status": "unknown",
      "derived": true
    },
    {
      "server": "intercom",
      "feature": "mcp.prm.scopes-supported",
      "revision": "2025-11-25",
      "status": "unknown",
      "derived": true
    },
    {
      "server": "intercom",
      "feature": "mcp.prm.well-known",
      "revision": "2025-11-25",
      "status": "unknown",
      "derived": true
    },
    {
      "server": "intercom",
      "feature": "mcp.prm.www-authenticate",
      "revision": "2025-11-25",
      "status": "unknown",
      "derived": true
    },
    {
      "server": "intercom",
      "feature": "mcp.as.cimd",
      "revision": "2025-11-25",
      "status": "unknown",
      "derived": true
    },
    {
      "server": "intercom",
      "feature": "mcp.as.dcr",
      "revision": "2025-11-25",
      "status": "unknown",
      "derived": true
    },
    {
      "server": "intercom",
      "feature": "mcp.as.preregistration",
      "revision": "2025-11-25",
      "status": "unknown",
      "derived": true
    },
    {
      "server": "intercom",
      "feature": "mcp.as.pkce-s256",
      "revision": "2025-11-25",
      "status": "unknown",
      "derived": true
    },
    {
      "server": "intercom",
      "feature": "mcp.rs.insufficient-scope",
      "revision": "2025-11-25",
      "status": "unknown",
      "derived": true
    },
    {
      "server": "intercom",
      "feature": "mcp.rs.scope-challenge",
      "revision": "2025-11-25",
      "status": "unknown",
      "derived": true
    },
    {
      "server": "intercom",
      "feature": "mcp.as.refresh-rotation",
      "revision": "2025-11-25",
      "status": "unknown",
      "derived": true
    },
    {
      "server": "intercom",
      "feature": "mcp.as.resource-indicator",
      "revision": "2025-11-25",
      "status": "unknown",
      "derived": true
    },
    {
      "server": "intercom",
      "feature": "mcp.rs.401-on-invalid",
      "revision": "2025-11-25",
      "status": "unknown",
      "derived": true
    },
    {
      "server": "intercom",
      "feature": "mcp.rs.audience-validation",
      "revision": "2025-11-25",
      "status": "unknown",
      "derived": true
    },
    {
      "server": "intercom",
      "feature": "mcp.rs.bearer-header",
      "revision": "2025-11-25",
      "status": "unknown",
      "derived": true
    },
    {
      "server": "intercom",
      "feature": "mcp.as.https",
      "revision": "2025-11-25",
      "status": "unknown",
      "derived": true
    },
    {
      "server": "intercom",
      "feature": "mcp.rs.no-passthrough",
      "revision": "2025-11-25",
      "status": "unknown",
      "derived": true
    },
    {
      "server": "intercom",
      "feature": "mcp.proxy.consent",
      "revision": "2025-11-25",
      "status": "unknown",
      "derived": true
    },
    {
      "server": "intercom",
      "feature": "mcp.as.issuer-match",
      "revision": "2026-07-28",
      "status": "unknown",
      "derived": true
    },
    {
      "server": "intercom",
      "feature": "mcp.as.metadata",
      "revision": "2026-07-28",
      "status": "unknown",
      "derived": true
    },
    {
      "server": "intercom",
      "feature": "mcp.prm",
      "revision": "2026-07-28",
      "status": "unknown",
      "derived": true
    },
    {
      "server": "intercom",
      "feature": "mcp.prm.authorization-servers",
      "revision": "2026-07-28",
      "status": "unknown",
      "derived": true
    },
    {
      "server": "intercom",
      "feature": "mcp.prm.scopes-supported",
      "revision": "2026-07-28",
      "status": "unknown",
      "derived": true
    },
    {
      "server": "intercom",
      "feature": "mcp.prm.well-known",
      "revision": "2026-07-28",
      "status": "unknown",
      "derived": true
    },
    {
      "server": "intercom",
      "feature": "mcp.prm.www-authenticate",
      "revision": "2026-07-28",
      "status": "unknown",
      "derived": true
    },
    {
      "server": "intercom",
      "feature": "mcp.as.cimd",
      "revision": "2026-07-28",
      "status": "unknown",
      "derived": true
    },
    {
      "server": "intercom",
      "feature": "mcp.as.dcr",
      "revision": "2026-07-28",
      "status": "partial",
      "derived": false
    },
    {
      "server": "intercom",
      "feature": "mcp.as.preregistration",
      "revision": "2026-07-28",
      "status": "unknown",
      "derived": true
    },
    {
      "server": "intercom",
      "feature": "mcp.as.iss-param",
      "revision": "2026-07-28",
      "status": "unknown",
      "derived": true
    },
    {
      "server": "intercom",
      "feature": "mcp.as.pkce-s256",
      "revision": "2026-07-28",
      "status": "unknown",
      "derived": true
    },
    {
      "server": "intercom",
      "feature": "mcp.rs.insufficient-scope",
      "revision": "2026-07-28",
      "status": "unknown",
      "derived": true
    },
    {
      "server": "intercom",
      "feature": "mcp.rs.scope-challenge",
      "revision": "2026-07-28",
      "status": "unknown",
      "derived": true
    },
    {
      "server": "intercom",
      "feature": "mcp.as.refresh-rotation",
      "revision": "2026-07-28",
      "status": "unknown",
      "derived": true
    },
    {
      "server": "intercom",
      "feature": "mcp.as.resource-indicator",
      "revision": "2026-07-28",
      "status": "unknown",
      "derived": true
    },
    {
      "server": "intercom",
      "feature": "mcp.prm.no-offline-access",
      "revision": "2026-07-28",
      "status": "unknown",
      "derived": true
    },
    {
      "server": "intercom",
      "feature": "mcp.rs.401-on-invalid",
      "revision": "2026-07-28",
      "status": "unknown",
      "derived": true
    },
    {
      "server": "intercom",
      "feature": "mcp.rs.audience-validation",
      "revision": "2026-07-28",
      "status": "unknown",
      "derived": true
    },
    {
      "server": "intercom",
      "feature": "mcp.rs.bearer-header",
      "revision": "2026-07-28",
      "status": "unknown",
      "derived": true
    },
    {
      "server": "intercom",
      "feature": "mcp.as.https",
      "revision": "2026-07-28",
      "status": "unknown",
      "derived": true
    },
    {
      "server": "intercom",
      "feature": "mcp.rs.no-passthrough",
      "revision": "2026-07-28",
      "status": "unknown",
      "derived": true
    },
    {
      "server": "intercom",
      "feature": "mcp.proxy.consent",
      "revision": "2026-07-28",
      "status": "supported",
      "derived": false
    }
  ],
  "observations": [
    {
      "server": "intercom",
      "feature": "mcp.as.dcr",
      "revision": "2026-07-28",
      "status": "unknown",
      "method": "vendor-claim",
      "observedAt": "2026-10-13T00:00:00Z",
      "observedBy": "jbspeakr",
      "evidence": "https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as OAuth 2.1 without saying whether Dynamic Client Registration is offered."
    },
    {
      "server": "intercom",
      "feature": "mcp.as.dcr",
      "revision": "2026-07-28",
      "status": "partial",
      "method": "vendor-claim",
      "observedAt": "2026-10-14T00:00:00Z",
      "observedBy": "jbspeakr (documentation pass with Claude Code)",
      "evidence": "https://developers.intercom.com/docs/guides/mcp — \"OAuth client registration is automatic — the server supports Dynamic Client Registration. However, every redirect URI a client registers is checked against an allowlist, which controls where the server will send authorization responses.\" (OAuth with a callback on localhost or 127.0.0.1 is allowed on any port; any other callback needs an allowlist entry requested via Intercom Customer Support before the flow will complete.)"
    },
    {
      "server": "intercom",
      "feature": "mcp.proxy.consent",
      "revision": "2026-07-28",
      "status": "supported",
      "method": "vendor-claim",
      "observedAt": "2026-10-14T00:00:00Z",
      "observedBy": "jbspeakr (documentation pass with Claude Code)",
      "evidence": "https://developers.intercom.com/docs/guides/mcp — \"This names the application asking to connect, lists what it will be able to do in your workspace, and shows its Client ID and the address it redirects to after you approve. [...] This asks you to authorize access for Intercom MCP, the server, rather than for the application.\" (Two screens: the Intercom MCP consent page for the dynamically registered client, then Intercom's own authorization screen for the MCP server's upstream client. Docs add that the application name is supplied by the application and not verified by Intercom.)"
    }
  ]
}