Skip to content

Server

Netlify

Endpoint: https://netlify-mcp.netlify.app/mcp
Transport: Streamable HTTP
Authentication as listed: oauth2.1 (the source's own label, not an observation)
Why it is listed: Listed because it appears in a public directory of MCP servers. Source
Homepage: https://netlify.com

Unknown 23

Contribute a correction Withdraw this server JSON

Status against MCP Authorization 2026-07-28 (current revision). Older revisions: 2025-11-25

MCP server features

Feature	Level	Status	Observed	Evidence
Protected Resource Metadata served`mcp.prm` · Discovery · Authorization Server Discovery › Authorization Server Location	MUST	Unknown (no observation)	no observation yet
PRM lists an authorization server`mcp.prm.authorization-servers` · Discovery · Authorization Server Discovery › Authorization Server Location	MUST	Unknown (no observation)	no observation yet
PRM lists scopes_supported`mcp.prm.scopes-supported` · Discovery · Authorization › Scope Selection Strategy	MAY	Unknown (no observation)	no observation yet
PRM reachable at a well-known URI`mcp.prm.well-known` · Discovery · Authorization Server Discovery › Protected Resource Metadata Discovery Requirements	MUST	Unknown (no observation)	no observation yet
resource_metadata in the 401 challenge`mcp.prm.www-authenticate` · Discovery · Authorization Server Discovery › Protected Resource Metadata Discovery Requirements	MUST	Unknown (no observation)	no observation yet
403 insufficient_scope for step-up`mcp.rs.insufficient-scope` · Authorization · Authorization › Scope Challenge Handling	SHOULD	Unknown (no observation)	no observation yet
Scope in the WWW-Authenticate challenge`mcp.rs.scope-challenge` · Authorization · Authorization › Scope Selection Strategy	SHOULD	Unknown (no observation)	no observation yet
No offline_access in advertised scopes`mcp.prm.no-offline-access` · Tokens · Authorization › Refresh Tokens	SHOULD	Unknown (no observation)	no observation yet
401 for missing or invalid tokens`mcp.rs.401-on-invalid` · Tokens · Authorization › Token Handling	MUST	Unknown (no observation)	no observation yet
Audience validation`mcp.rs.audience-validation` · Tokens · Security Considerations › Access Token Privilege Restriction	MUST	Unknown (no observation)	no observation yet
Bearer token only in the Authorization header`mcp.rs.bearer-header` · Tokens · Authorization › Access Token Usage	MUST	Unknown (no observation)	no observation yet
No token passthrough to upstream APIs`mcp.rs.no-passthrough` · Delegation · Security Considerations › Access Token Privilege Restriction	MUST	Unknown (no observation)	no observation yet
Per-client consent on proxy servers`mcp.proxy.consent` · Consent · Security Considerations › Confused Deputy Problem	MUST	Unknown (no observation)	no observation yet

Authorization server features

Feature	Level	Status	Observed	Evidence
Metadata issuer matches the discovery URL`mcp.as.issuer-match` · Discovery · Authorization Server Discovery › Authorization Server Metadata Discovery	MUST	Unknown (no observation)	no observation yet
Authorization server metadata discoverable`mcp.as.metadata` · Discovery · Authorization Server Discovery › Authorization Server Metadata Discovery	MUST	Unknown (no observation)	no observation yet
Client ID Metadata Documents supported`mcp.as.cimd` · Registration · Client Registration › Client ID Metadata Documents	SHOULD	Unknown (no observation)	no observation yet
Dynamic Client Registration offered`mcp.as.dcr` · Registration · Client Registration › Dynamic Client Registration	MAY	Unknown	2026-10-13Vendor claim · jbspeakr	sourcelists the server as OAuth 2.1 without saying whether Dynamic Client Registration is offered.
Documented pre-registration path`mcp.as.preregistration` · Registration · Client Registration › Pre-registration	SHOULD	Unknown (no observation)	no observation yet
Issuer identifier in authorization responses`mcp.as.iss-param` · Authorization · Authorization › Authorization Response Validation	SHOULD	Unknown (no observation)	no observation yet
PKCE with S256 advertised`mcp.as.pkce-s256` · Authorization · Security Considerations › Authorization Code Protection	MUST	Unknown (no observation)	no observation yet
Refresh token rotation for public clients`mcp.as.refresh-rotation` · Tokens · Security Considerations › Token Theft	MUST	Unknown (no observation)	no observation yet
Resource indicators honoured`mcp.as.resource-indicator` · Tokens · Security Considerations › Token Audience Binding and Validation	MUST	Unknown (no observation)	no observation yet
All endpoints served over HTTPS`mcp.as.https` · Transport · Security Considerations › Communication Security	MUST	Unknown (no observation)	no observation yet