LedgerRecord of · MCP Authorization 2026-07-28

Ledger

Every status change on record

Newest first. Nothing in it is ever edited or removed.

Status changes
124
Cells that changed
102
Days with a change
7

  1. NeonClient ID Metadata Documents supported

    →Supported

    Passive scan · observed 4 times · source

    HTTP 200; client_id_metadata_document_supported: true

    3 earlier observations
    1. · Unsupported · Passive scan
    2. · Unsupported · Passive scan
    3. · Unsupported · Passive scan
  2. NeonIssuer identifier in authorization responses

    →Supported

    Passive scan · observed 4 times · source

    HTTP 200; authorization_response_iss_parameter_supported: true

    3 earlier observations
    1. · Unsupported · Passive scan
    2. · Unsupported · Passive scan
    3. · Unsupported · Passive scan

  1. VercelClient ID Metadata Documents supported

    →Supported

    Passive scan · observed 4 times · source

    HTTP 200; client_id_metadata_document_supported: true

    3 earlier observations
    1. · Unsupported · Passive scan
    2. · Unsupported · Passive scan
    3. · Unsupported · Passive scan

  1. BoxMetadata issuer matches the discovery URL

    →Unsupported

    Passive scan · observed 3 times · source

    HTTP 200; issuer: https://api.box.com, PRM named https://api.box.com/

    2 earlier observations
    1. · Supported · Passive scan
    2. · Supported · Passive scan
  2. BoxPRM reachable at a well-known URI

    →Unsupported

    Passive scan · observed 4 times · source

    HTTP 200; not at either well-known location (root HTTP 200, root HTTP 200)

    3 earlier observations
    1. · Supported · Passive scan
    2. · Supported · Passive scan
    3. · Supported · Vendor claim
  3. BuildkiteNo offline_access in advertised scopes

    →Unknown

    Passive scan · observed 3 times · source

    HTTP 200; scopes_supported: absent, so no scope is advertised to judge

    2 earlier observations
    1. · Supported · Passive scan
    2. · Unknown · Passive scan
  4. HubSpot11 cells changed in one run

    10 1

  5. MiroPRM reachable at a well-known URI

    →Unsupported

    Passive scan · observed 3 times · source

    HTTP 200; not at either well-known location (root HTTP 200, root HTTP 200)

    2 earlier observations
    1. · Supported · Passive scan
    2. · Supported · Passive scan
  6. monday.com11 cells changed in one run

    9 2

  7. NeonNo offline_access in advertised scopes

    →Unknown

    Passive scan · observed 3 times · source

    HTTP 200; scopes_supported: absent, so no scope is advertised to judge

    2 earlier observations
    1. · Supported · Passive scan
    2. · Unknown · Passive scan
  8. VercelPRM reachable at a well-known URI

    →Unsupported

    Passive scan · observed 3 times · source

    HTTP 200; not at either well-known location (root HTTP 200, root HTTP 200)

    2 earlier observations
    1. · Supported · Passive scan
    2. · Supported · Passive scan

  1. HubSpot14 cells changed in one run

    6 8

  2. Zapier14 cells changed in one run

    4 10

  1. Airtableresource_metadata in the 401 challenge

    →Supported

    Passive scan · observed 3 times · source

    HTTP 401; WWW-Authenticate resource_metadata: https://mcp.airtable.com/.well-known/oauth-protected-resource

    2 earlier observations
    1. · Supported · Passive scan
    2. · Unknown · Passive scan
  2. Atlassian13 cells changed in one run

    11 2

  3. Attioresource_metadata in the 401 challenge

    →Supported

    Passive scan · observed 3 times · source

    HTTP 401; WWW-Authenticate resource_metadata: https://mcp.attio.com/.well-known/oauth-protected-resource

    2 earlier observations
    1. · Supported · Passive scan
    2. · Unknown · Passive scan
  4. BuildkiteNo offline_access in advertised scopes

    →Supported

    Passive scan · observed 3 times · source

    HTTP 200; the authorization server's scopes_supported has no offline_access: [read, write]; the server advertises no scopes of its own

    2 earlier observations
    1. · Unknown · Passive scan
    2. · Unknown · Passive scan
  5. Cloudflare Workersresource_metadata in the 401 challenge

    →Supported

    Passive scan · observed 3 times · source

    HTTP 401; WWW-Authenticate resource_metadata: https://bindings.mcp.cloudflare.com/.well-known/oauth-protected-resource/mcp

    2 earlier observations
    1. · Supported · Passive scan
    2. · Unknown · Passive scan
  6. FigmaDynamic Client Registration offered

    →Supported

    Passive scan · observed 5 times · source

    HTTP 200; registration_endpoint: https://api.figma.com/v1/oauth/mcp/register

    4 earlier observations
    1. · Supported · Passive scan
    2. · Partial · Manual check
    3. · Supported · Passive scan
    4. · Unsupported · Vendor claim
  7. Linearresource_metadata in the 401 challenge

    →Supported

    Passive scan · observed 3 times · source

    HTTP 401; WWW-Authenticate resource_metadata: https://mcp.linear.app/.well-known/oauth-protected-resource/mcp

    2 earlier observations
    1. · Supported · Passive scan
    2. · Unknown · Passive scan
  8. NeonNo offline_access in advertised scopes

    →Supported

    Passive scan · observed 3 times · source

    HTTP 200; the authorization server's scopes_supported has no offline_access: [read, write]; the server advertises no scopes of its own

    2 earlier observations
    1. · Unknown · Passive scan
    2. · Unknown · Passive scan
  9. Sentry3 cells changed in one run

    3

  10. Stack Overflowresource_metadata in the 401 challenge

    →Unsupported

    Passive scan · observed 3 times · source

    HTTP 401; WWW-Authenticate: Bearer, no resource_metadata parameter

    2 earlier observations
    1. · Unsupported · Passive scan
    2. · Unknown · Passive scan
  11. Zoomresource_metadata in the 401 challenge

    →Supported

    Passive scan · observed 4 times · source

    HTTP 401; WWW-Authenticate resource_metadata: https://mcp.zoom.us/.well-known/oauth-protected-resource/mcp/zoom/streamable

    3 earlier observations
    1. · Supported · Passive scan
    2. · Supported · Passive scan
    3. · Unknown · Passive scan

  1. FigmaDynamic Client Registration offered

    →Partial

    Manual check · observed 5 times · source

    Figma staff (2026-04-02): the mcp:connect scope is not available to general third-party OAuth apps, MCP access is limited to supported clie…

    4 earlier observations
    1. · Supported · Passive scan
    2. · Supported · Passive scan
    3. · Supported · Passive scan
    4. · Unsupported · Vendor claim
  2. FigmaDynamic Client Registration offered

    →Supported

    Passive scan · observed 5 times · source

    HTTP 200; registration_endpoint: https://api.figma.com/v1/oauth/mcp/register

    4 earlier observations
    1. · Supported · Passive scan
    2. · Supported · Passive scan
    3. · Partial · Manual check
    4. · Unsupported · Vendor claim
  3. AsanaDynamic Client Registration offered

    →Supported

    Passive scan · observed 5 times · source

    HTTP 200; registration_endpoint: https://mcp.asana.com/register

    4 earlier observations
    1. · Supported · Passive scan
    2. · Supported · Passive scan
    3. · Unsupported · Vendor claim
    4. · Unknown · Vendor claim
  4. AtlassianDynamic Client Registration offered

    →Unknown

    Passive scan · observed 4 times · source

    HTTP 404; no protected resource metadata at a well-known location (HTTP 404, HTTP 404) and none reached through the challenge (challenge wi…

    3 earlier observations
    1. · Supported · Passive scan
    2. · Supported · Passive scan
    3. · Unsupported · Vendor claim
  5. AttioDynamic Client Registration offered

    →Supported

    Passive scan · observed 4 times · source

    HTTP 200; registration_endpoint: https://app.attio.com/oauth/register

    3 earlier observations
    1. · Supported · Passive scan
    2. · Supported · Passive scan
    3. · Unknown · Vendor claim
  6. BuildkiteDynamic Client Registration offered

    →Supported

    Passive scan · observed 4 times · source

    HTTP 200; registration_endpoint: https://mcp.buildkite.com/oauth/register

    3 earlier observations
    1. · Supported · Passive scan
    2. · Supported · Passive scan
    3. · Unknown · Vendor claim
  7. CanvaDynamic Client Registration offered

    →Supported

    Passive scan · observed 5 times · source

    HTTP 200; registration_endpoint: https://mcp.canva.com/register

    4 earlier observations
    1. · Supported · Passive scan
    2. · Supported · Passive scan
    3. · Partial · Vendor claim
    4. · Unknown · Vendor claim
  8. ClickUpPKCE with S256 advertised

    →Supported

    Passive scan · observed 4 times · source

    HTTP 200; code_challenge_methods_supported: [S256]

    3 earlier observations
    1. · Supported · Passive scan
    2. · Supported · Passive scan
    3. · Partial · Vendor claim
  9. Cloudflare WorkersDynamic Client Registration offered

    →Supported

    Passive scan · observed 4 times · source

    HTTP 200; registration_endpoint: https://bindings.mcp.cloudflare.com/register

    3 earlier observations
    1. · Supported · Passive scan
    2. · Supported · Passive scan
    3. · Unknown · Vendor claim
  10. CloudinaryDynamic Client Registration offered

    →Supported

    Passive scan · observed 4 times · source

    HTTP 200; registration_endpoint: https://asset-management.mcp.cloudinary.com/register

    3 earlier observations
    1. · Supported · Passive scan
    2. · Supported · Passive scan
    3. · Unknown · Vendor claim
  11. GitHubPKCE with S256 advertised

    →Supported

    Passive scan · observed 4 times · source

    HTTP 200; code_challenge_methods_supported: [S256]

    3 earlier observations
    1. · Supported · Passive scan
    2. · Supported · Passive scan
    3. · Partial · Vendor claim
  12. IntercomDynamic Client Registration offered

    →Supported

    Passive scan · observed 5 times · source

    HTTP 200; registration_endpoint: https://mcp.intercom.com/register

    4 earlier observations
    1. · Supported · Passive scan
    2. · Supported · Passive scan
    3. · Partial · Vendor claim
    4. · Unknown · Vendor claim
  13. MiroDynamic Client Registration offered

    →Supported

    Passive scan · observed 4 times · source

    HTTP 200; registration_endpoint: https://mcp.miro.com/register

    3 earlier observations
    1. · Supported · Passive scan
    2. · Supported · Passive scan
    3. · Unknown · Vendor claim
  14. monday.comPKCE with S256 advertised

    →Supported

    Passive scan · observed 4 times · source

    HTTP 200; code_challenge_methods_supported: [S256]

    3 earlier observations
    1. · Unknown · Passive scan
    2. · Supported · Passive scan
    3. · Partial · Vendor claim
  15. NeonDynamic Client Registration offered

    →Supported

    Passive scan · observed 4 times · source

    HTTP 200; registration_endpoint: https://mcp.neon.tech/api/register

    3 earlier observations
    1. · Supported · Passive scan
    2. · Supported · Passive scan
    3. · Unknown · Vendor claim
  16. NetlifyDynamic Client Registration offered

    →Supported

    Passive scan · observed 4 times · source

    HTTP 200; registration_endpoint: https://netlify-mcp.netlify.app/oauth-server/reg

    3 earlier observations
    1. · Supported · Passive scan
    2. · Supported · Passive scan
    3. · Unknown · Vendor claim
  17. NotionPKCE with S256 advertised

    →Supported

    Passive scan · observed 4 times · source

    HTTP 200; code_challenge_methods_supported: [S256]

    3 earlier observations
    1. · Supported · Passive scan
    2. · Supported · Passive scan
    3. · Unsupported · Vendor claim
  18. PayPalDynamic Client Registration offered

    →Supported

    Passive scan · observed 4 times · source

    HTTP 200; registration_endpoint: https://mcp.paypal.com/register

    3 earlier observations
    1. · Supported · Passive scan
    2. · Supported · Passive scan
    3. · Unknown · Vendor claim
  19. PlaidDynamic Client Registration offered

    →Unknown

    Passive scan · observed 4 times · source

    HTTP 404; no protected resource metadata at a well-known location (HTTP 404, HTTP 404) and none reached through the challenge (challenge wi…

    3 earlier observations
    1. · Unknown · Passive scan
    2. · Unknown · Passive scan
    3. · Unsupported · Vendor claim
  20. Prisma PostgresDynamic Client Registration offered

    →Supported

    Passive scan · observed 4 times · source

    HTTP 200; registration_endpoint: https://auth.prisma.io/register

    3 earlier observations
    1. · Supported · Passive scan
    2. · Supported · Passive scan
    3. · Unknown · Vendor claim
  21. RampDynamic Client Registration offered

    →Supported

    Passive scan · observed 4 times · source

    HTTP 200; registration_endpoint: https://ramp-mcp-remote.ramp.com/register

    3 earlier observations
    1. · Supported · Passive scan
    2. · Supported · Passive scan
    3. · Unknown · Vendor claim
  22. SentryDynamic Client Registration offered

    →Supported

    Passive scan · observed 4 times · source

    HTTP 200; registration_endpoint: https://mcp.sentry.dev/oauth/register

    3 earlier observations
    1. · Supported · Passive scan
    2. · Supported · Passive scan
    3. · Unknown · Vendor claim
  23. SquareDynamic Client Registration offered

    →Supported

    Passive scan · observed 5 times · source

    HTTP 200; registration_endpoint: https://mcp.squareup.com/register

    4 earlier observations
    1. · Supported · Passive scan
    2. · Supported · Passive scan
    3. · Partial · Vendor claim
    4. · Unknown · Vendor claim
  24. StripeDynamic Client Registration offered

    →Supported

    Passive scan · observed 4 times · source

    HTTP 200; registration_endpoint: https://access.stripe.com/mcp/oauth2/register

    3 earlier observations
    1. · Supported · Passive scan
    2. · Supported · Passive scan
    3. · Unknown · Vendor claim
  25. TodoistDynamic Client Registration offered

    →Supported

    Passive scan · observed 4 times · source

    HTTP 200; registration_endpoint: https://todoist.com/oauth/register

    3 earlier observations
    1. · Supported · Passive scan
    2. · Supported · Passive scan
    3. · Unknown · Vendor claim
  26. VercelDynamic Client Registration offered

    →Supported

    Passive scan · observed 4 times · source

    HTTP 200; registration_endpoint: https://api.vercel.com/login/oauth/register

    3 earlier observations
    1. · Supported · Passive scan
    2. · Supported · Passive scan
    3. · Unknown · Vendor claim
  27. WebflowDynamic Client Registration offered

    →Supported

    Passive scan · observed 4 times · source

    HTTP 200; registration_endpoint: https://mcp.webflow.com/oauth/register

    3 earlier observations
    1. · Supported · Passive scan
    2. · Supported · Passive scan
    3. · Unknown · Vendor claim
  28. WixDynamic Client Registration offered

    →Supported

    Passive scan · observed 4 times · source

    HTTP 200; registration_endpoint: https://mcp.wix.com/register

    3 earlier observations
    1. · Supported · Passive scan
    2. · Supported · Passive scan
    3. · Unknown · Vendor claim
  29. ZoomPKCE with S256 advertised

    →Supported

    Passive scan · observed 4 times · source

    HTTP 200; code_challenge_methods_supported: [S256]

    3 earlier observations
    1. · Supported · Passive scan
    2. · Supported · Passive scan
    3. · Partial · Vendor claim

  1. AirtableDynamic Client Registration offered

    →Supported

    Vendor claim · observed 5 times · source

    "Our server supports Dynamic Client Registration (DCR)."

    4 earlier observations
    1. · Supported · Passive scan
    2. · Supported · Passive scan
    3. · Supported · Passive scan
    4. · Unknown · Vendor claim
  2. AsanaDynamic Client Registration offered

    →Unsupported

    Vendor claim · observed 5 times · source

    "Dynamic client registration is not supported with Asana’s V2 MCP Server."

    4 earlier observations
    1. · Supported · Passive scan
    2. · Supported · Passive scan
    3. · Supported · Passive scan
    4. · Unknown · Vendor claim
  3. CanvaDynamic Client Registration offered

    →Partial

    Vendor claim · observed 5 times · source

    "Dynamic Client Registration (DCR) is deprecated in favor of CIMD, but it remains available for backward compatibility." (Deprecated; still…

    4 earlier observations
    1. · Supported · Passive scan
    2. · Supported · Passive scan
    3. · Supported · Passive scan
    4. · Unknown · Vendor claim
  4. ClickUpDynamic Client Registration offered

    →Supported

    Vendor claim · observed 5 times · source

    "For Authentication, select OAuth. Ensure the configuration is set to Dynamic Discovery (DCR)." (Only stated as a Microsoft Copilot Studio…

    4 earlier observations
    1. · Supported · Passive scan
    2. · Supported · Passive scan
    3. · Supported · Passive scan
    4. · Unsupported · Vendor claim
  5. IntercomDynamic Client Registration offered

    →Partial

    Vendor claim · observed 5 times · source

    "OAuth client registration is automatic — the server supports Dynamic Client Registration. However, every redirect URI a client registers i…

    4 earlier observations
    1. · Supported · Passive scan
    2. · Supported · Passive scan
    3. · Supported · Passive scan
    4. · Unknown · Vendor claim
  6. LinearDynamic Client Registration offered

    →Supported

    Vendor claim · observed 5 times · source

    "The interactive setup flow uses OAuth 2.1 with dynamic client registration."

    4 earlier observations
    1. · Supported · Passive scan
    2. · Supported · Passive scan
    3. · Supported · Passive scan
    4. · Unknown · Vendor claim
  7. monday.comDynamic Client Registration offered

    →Supported

    Vendor claim · observed 5 times · source

    "Instead, they authenticate through OAuth 2.0 Dynamic Client Registration" (Registration endpoint listed as https://mcp.monday.com/register…

    4 earlier observations
    1. · Unknown · Passive scan
    2. · Supported · Passive scan
    3. · Supported · Passive scan
    4. · Unknown · Vendor claim
  8. NotionDynamic Client Registration offered

    →Supported

    Vendor claim · observed 5 times · source

    "Notion MCP server supports dynamic client registration (RFC 7591)." (Guide tells clients to persist client_id and client_secret 'because r…

    4 earlier observations
    1. · Supported · Passive scan
    2. · Supported · Passive scan
    3. · Supported · Passive scan
    4. · Unknown · Vendor claim
  9. SquareDynamic Client Registration offered

    →Partial

    Vendor claim · observed 5 times · source

    "Square maintains an allowlist of MCP clients in order to protect against malicious client registration attempts." (Docs speak of client re…

    4 earlier observations
    1. · Supported · Passive scan
    2. · Supported · Passive scan
    3. · Supported · Passive scan
    4. · Unknown · Vendor claim
  10. SupabaseDynamic Client Registration offered

    →Supported

    Vendor claim · observed 5 times · source

    "By default the hosted Supabase MCP server uses dynamic client registration to authenticate with your Supabase org."

    4 earlier observations
    1. · Supported · Passive scan
    2. · Supported · Passive scan
    3. · Supported · Passive scan
    4. · Unknown · Vendor claim
  11. ZoomDynamic Client Registration offered

    →Unsupported

    Vendor claim · observed 5 times · source

    "Zoom remote MCP servers only support manual client registration through app creation and do not support other client registration methods…

    4 earlier observations
    1. · Unsupported · Passive scan
    2. · Unsupported · Passive scan
    3. · Unsupported · Passive scan
    4. · Unknown · Vendor claim