MCP auth atlas

Who supports what in MCP Authorization

Every public MCP server we list, against every requirement the specification puts on servers and their authorization servers. Each cell cites an observation; nothing here is inferred from silence.

Servers: 39
Requirements: 23
Cells observed: 611 / 897
Access: 34 public, 4 closed, 1 unknown
Auth: 34 oauth, 3 no authentication, 2 unknown

Revision2026-07-28currentpublished 2026-07-28 · MCP Authorization 2026-07-28 · About this specification

Supported
Partial
Unsupported
Unknown
Not applicable
Unknown no observation

MUST, SHOULD and MAY are the requirement levels the revision puts on the feature. RS and AS name the party the feature is observed on. The letter next to a server's name is the nightly scanner's grade over the 14 requirements it can read from public metadata, by a published rule; it opens the server's report. Rows are alphabetical and nothing here ranks servers.

Access: public · closed · unknown: who can connect, as the server page's evidence says.
Auth: oauth · api key · no authentication · unknown: how the endpoint authenticates clients. A dashed pill is a class nobody has stated yet. Both are evidenced statements, not the directory's label; API-key and unauthenticated servers are not graded.

Support for each feature of MCP Authorization 2026-07-28 by server. Rows are servers in alphabetical order; columns are features grouped by category.
Server39 listed, A to Z · nightly scan grade	issuer-matchMetadata issuer matches the discovery URLMUSTAuthorization server	metadataAuthorization server metadata discoverableMUSTAuthorization server	mcp.prmProtected Resource Metadata servedMUSTMCP server	authorization-serversPRM lists an authorization serverMUSTMCP server	scopes-supportedPRM lists scopes_supportedMAYMCP server	well-knownPRM reachable at a well-known URIMUSTMCP server	www-authenticateresource_metadata in the 401 challengeMUSTMCP server	cimdClient ID Metadata Documents supportedSHOULDAuthorization server	Level changed in 2026-07-28dcrDynamic Client Registration offeredMAYAuthorization server	preregistrationDocumented pre-registration pathSHOULDAuthorization server	New in 2026-07-28iss-paramIssuer identifier in authorization responsesSHOULDAuthorization server	pkce-s256PKCE with S256 advertisedMUSTAuthorization server	insufficient-scope403 insufficient_scope for step-upSHOULDMCP server	scope-challengeScope in the WWW-Authenticate challengeSHOULDMCP server	refresh-rotationRefresh token rotation for public clientsMUSTAuthorization server	resource-indicatorResource indicators honouredMUSTAuthorization server	New in 2026-07-28no-offline-accessNo offline_access in advertised scopesSHOULDMCP server	401-on-invalid401 for missing or invalid tokensMUSTMCP server	audience-validationAudience validationMUSTMCP server	bearer-headerBearer token only in the Authorization headerMUSTMCP server	httpsAll endpoints served over HTTPSMUSTAuthorization server	no-passthroughNo token passthrough to upstream APIsMUSTMCP server	consentPer-client consent on proxy serversMUSTMCP server
	Discovery							Registration			Authorization				Tokens						Transport	Delegation	Consent
Airtable CAccess: publicAuth: oauth	Supported Airtable Metadata issuer matches the discovery URL Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://airtable.com/.well-known/oauth-authorization-server/oauth2/v1 — HTTP 200; issuer: https://airtable.com/oauth2/v1 equals the issuer the PRM named Revision 2026-07-28	Supported Airtable Authorization server metadata discoverable Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://airtable.com/.well-known/oauth-authorization-server/oauth2/v1 — HTTP 200; issuer: https://airtable.com/oauth2/v1 Revision 2026-07-28	Supported Airtable Protected Resource Metadata served Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.airtable.com/.well-known/oauth-protected-resource/mcp — HTTP 200; resource: https://mcp.airtable.com Revision 2026-07-28	Supported Airtable PRM lists an authorization server Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.airtable.com/.well-known/oauth-protected-resource/mcp — HTTP 200; authorization_servers: [https://airtable.com/oauth2/v1] Revision 2026-07-28	Supported Airtable PRM lists scopes_supported Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.airtable.com/.well-known/oauth-protected-resource/mcp — HTTP 200; scopes_supported: [data.records:read, data.records:write, schema.bases:read, schema.bases:write, data.recordComments:read, data.recordComments:write, workspacesAndBases:read] Revision 2026-07-28	Supported Airtable PRM reachable at a well-known URI Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.airtable.com/.well-known/oauth-protected-resource/mcp — HTTP 200; found at the path-aware location Revision 2026-07-28	Supported Airtable resource_metadata in the 401 challenge Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.airtable.com/mcp — HTTP 401; WWW-Authenticate resource_metadata: https://mcp.airtable.com/.well-known/oauth-protected-resource Revision 2026-07-28	Supported Airtable Client ID Metadata Documents supported Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://airtable.com/.well-known/oauth-authorization-server/oauth2/v1 — HTTP 200; client_id_metadata_document_supported: true Revision 2026-07-28	Supported Airtable Dynamic Client Registration offered Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://airtable.com/.well-known/oauth-authorization-server/oauth2/v1 — HTTP 200; registration_endpoint: https://airtable.com/oauth2/v1/register Revision 2026-07-28	Supported Airtable Documented pre-registration path Supported Method vendor-claim Observed 2026-10-14 by jbspeakr (documentation pass with Claude Code) Evidence https://airtable.com/developers/agents/mcp/other — "Some organizations want all users to authenticate through a single, allow-listable OAuth client instead of DCR. [...] Enter its OAuth client ID in your client's config file." (Client is registered through Airtable's OAuth integration setup with the redirect URI the MCP client requires; client secret optional.) Revision 2026-07-28	Unsupported Airtable Issuer identifier in authorization responses Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://airtable.com/.well-known/oauth-authorization-server/oauth2/v1 — HTTP 200; authorization_response_iss_parameter_supported: absent Revision 2026-07-28	Supported Airtable PKCE with S256 advertised Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://airtable.com/.well-known/oauth-authorization-server/oauth2/v1 — HTTP 200; code_challenge_methods_supported: [S256] Revision 2026-07-28	Unknown Airtable 403 insufficient_scope for step-up Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unsupported Airtable Scope in the WWW-Authenticate challenge Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.airtable.com/mcp — HTTP 401; WWW-Authenticate: Bearer error="invalid_token", error_description="Missing Authorization header", resource_metadata="https://mcp.airtable.com/.well-known/oauth-protected-resource", no scope parameter Revision 2026-07-28	Supported Airtable Refresh token rotation for public clients Supported Method vendor-claim Observed 2026-10-14 by jbspeakr (documentation pass with Claude Code) Evidence https://airtable.com/developers/web/api/oauth-reference — "the previous access and refresh tokens are invalidated and new tokens are returned." (Stated in Airtable's general OAuth reference; refresh tokens valid 60 days, access tokens 60 minutes.) Revision 2026-07-28	Unknown Airtable Resource indicators honoured Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported Airtable No offline_access in advertised scopes Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.airtable.com/.well-known/oauth-protected-resource/mcp — HTTP 200; scopes_supported without offline_access: [data.records:read, data.records:write, schema.bases:read, schema.bases:write, data.recordComments:read, data.recordComments:write, workspacesAndBases:read] Revision 2026-07-28	Unknown Airtable 401 for missing or invalid tokens Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Airtable Audience validation Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Airtable Bearer token only in the Authorization header Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported Airtable All endpoints served over HTTPS Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://airtable.com/.well-known/oauth-authorization-server/oauth2/v1 — HTTP 200; all 4 endpoints use https Revision 2026-07-28	Unknown Airtable No token passthrough to upstream APIs Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Airtable Per-client consent on proxy servers Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.
Asana CAccess: publicAuth: oauth	Supported Asana Metadata issuer matches the discovery URL Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.asana.com/.well-known/oauth-authorization-server — HTTP 200; issuer: https://mcp.asana.com equals the issuer the PRM named Revision 2026-07-28	Supported Asana Authorization server metadata discoverable Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.asana.com/.well-known/oauth-authorization-server — HTTP 200; issuer: https://mcp.asana.com Revision 2026-07-28	Supported Asana Protected Resource Metadata served Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.asana.com/.well-known/oauth-protected-resource — HTTP 200; resource: https://mcp.asana.com Revision 2026-07-28	Supported Asana PRM lists an authorization server Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.asana.com/.well-known/oauth-protected-resource — HTTP 200; authorization_servers: [https://mcp.asana.com] Revision 2026-07-28	Supported Asana PRM lists scopes_supported Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.asana.com/.well-known/oauth-protected-resource — HTTP 200; scopes_supported: [default] Revision 2026-07-28	Supported Asana PRM reachable at a well-known URI Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.asana.com/.well-known/oauth-protected-resource — HTTP 200; found at the root location Revision 2026-07-28	Supported Asana resource_metadata in the 401 challenge Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.asana.com/sse — HTTP 401; WWW-Authenticate resource_metadata: https://mcp.asana.com/.well-known/oauth-protected-resource Revision 2026-07-28	Unsupported Asana Client ID Metadata Documents supported Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.asana.com/.well-known/oauth-authorization-server — HTTP 200; client_id_metadata_document_supported: absent Revision 2026-07-28	Supported Asana Dynamic Client Registration offered Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.asana.com/.well-known/oauth-authorization-server — HTTP 200; registration_endpoint: https://mcp.asana.com/register Revision 2026-07-28	Supported Asana Documented pre-registration path Supported Method vendor-claim Observed 2026-10-14 by jbspeakr (documentation pass with Claude Code) Evidence https://developers.asana.com/docs/integrating-with-asanas-mcp-server — "Although these documents can be used to dynamically discover endpoints, clients must still pre-register to get a client id and client secret as described above." (App is created in the Asana developer console with app type 'MCP app'; tokens issued for MCP apps only work with the MCP server.) Revision 2026-07-28	Unsupported Asana Issuer identifier in authorization responses Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.asana.com/.well-known/oauth-authorization-server — HTTP 200; authorization_response_iss_parameter_supported: absent Revision 2026-07-28	Supported Asana PKCE with S256 advertised Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.asana.com/.well-known/oauth-authorization-server — HTTP 200; code_challenge_methods_supported: [plain, S256] Revision 2026-07-28	Unknown Asana 403 insufficient_scope for step-up Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unsupported Asana Scope in the WWW-Authenticate challenge Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.asana.com/sse — HTTP 401; WWW-Authenticate: Bearer realm="OAuth", resource_metadata="https://mcp.asana.com/.well-known/oauth-protected-resource", error="invalid_token", error_description="Missing or invalid access token", no scope parameter Revision 2026-07-28	Unknown Asana Refresh token rotation for public clients Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported Asana Resource indicators honoured Supported Method vendor-claim Observed 2026-10-14 by jbspeakr (documentation pass with Claude Code) Evidence https://developers.asana.com/docs/integrating-with-asanas-mcp-server — "When directing users to the authorization endpoint, you can include the resource parameter to specify the MCP server: [...] Tokens issued for MCP apps only work with the MCP server." (Docs describe the resource parameter as optional; values https://mcp.asana.com/v2 or https://mcp.asana.com/v2/command/mcp.) Revision 2026-07-28	Supported Asana No offline_access in advertised scopes Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.asana.com/.well-known/oauth-protected-resource — HTTP 200; scopes_supported without offline_access: [default] Revision 2026-07-28	Unknown Asana 401 for missing or invalid tokens Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Asana Audience validation Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Asana Bearer token only in the Authorization header Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported Asana All endpoints served over HTTPS Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.asana.com/.well-known/oauth-authorization-server — HTTP 200; all 4 endpoints use https Revision 2026-07-28	Unknown Asana No token passthrough to upstream APIs Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Asana Per-client consent on proxy servers Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.
Atlassian CAccess: publicAuth: oauth	Supported Atlassian Metadata issuer matches the discovery URL Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://auth.atlassian.com/.well-known/oauth-authorization-server/VCeDsk8ZHncYF1g234fKtc4lNipbBhu3 — HTTP 200; issuer: https://auth.atlassian.com/VCeDsk8ZHncYF1g234fKtc4lNipbBhu3 equals the issuer the PRM named Revision 2026-07-28	Supported Atlassian Authorization server metadata discoverable Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://auth.atlassian.com/.well-known/oauth-authorization-server/VCeDsk8ZHncYF1g234fKtc4lNipbBhu3 — HTTP 200; issuer: https://auth.atlassian.com/VCeDsk8ZHncYF1g234fKtc4lNipbBhu3 Revision 2026-07-28	Supported Atlassian Protected Resource Metadata served Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.atlassian.com/.well-known/oauth-protected-resource/v2/mcp — HTTP 200; resource: https://mcp.atlassian.com/v2/mcp Revision 2026-07-28	Supported Atlassian PRM lists an authorization server Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.atlassian.com/.well-known/oauth-protected-resource/v2/mcp — HTTP 200; authorization_servers: [https://auth.atlassian.com/VCeDsk8ZHncYF1g234fKtc4lNipbBhu3] Revision 2026-07-28	Supported Atlassian PRM lists scopes_supported Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.atlassian.com/.well-known/oauth-protected-resource/v2/mcp — HTTP 200; scopes_supported: [read:me, read:account, offline_access, email, read:jira:agent-interface, write:jira:agent-interface, search:jira:agent-interface, delete:jira:agent-interface, manage:jira:agent-interface, read:confl… Revision 2026-07-28	Supported Atlassian PRM reachable at a well-known URI Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.atlassian.com/.well-known/oauth-protected-resource/v2/mcp — HTTP 200; found at the path-aware location Revision 2026-07-28	Supported Atlassian resource_metadata in the 401 challenge Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.atlassian.com/v2/mcp — HTTP 401; WWW-Authenticate resource_metadata: https://mcp.atlassian.com/.well-known/oauth-protected-resource/v2/mcp Revision 2026-07-28	Supported Atlassian Client ID Metadata Documents supported Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://auth.atlassian.com/.well-known/oauth-authorization-server/VCeDsk8ZHncYF1g234fKtc4lNipbBhu3 — HTTP 200; client_id_metadata_document_supported: true Revision 2026-07-28	Supported Atlassian Dynamic Client Registration offered Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://auth.atlassian.com/.well-known/oauth-authorization-server/VCeDsk8ZHncYF1g234fKtc4lNipbBhu3 — HTTP 200; registration_endpoint: https://auth.atlassian.com/VCeDsk8ZHncYF1g234fKtc4lNipbBhu3/dcr/register Revision 2026-07-28	Unknown Atlassian Documented pre-registration path Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unsupported Atlassian Issuer identifier in authorization responses Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://auth.atlassian.com/.well-known/oauth-authorization-server/VCeDsk8ZHncYF1g234fKtc4lNipbBhu3 — HTTP 200; authorization_response_iss_parameter_supported: absent Revision 2026-07-28	Supported Atlassian PKCE with S256 advertised Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://auth.atlassian.com/.well-known/oauth-authorization-server/VCeDsk8ZHncYF1g234fKtc4lNipbBhu3 — HTTP 200; code_challenge_methods_supported: [S256] Revision 2026-07-28	Unknown Atlassian 403 insufficient_scope for step-up Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unsupported Atlassian Scope in the WWW-Authenticate challenge Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.atlassian.com/v2/mcp — HTTP 401; WWW-Authenticate: Bearer resource_metadata="https://mcp.atlassian.com/.well-known/oauth-protected-resource/v2/mcp", no scope parameter Revision 2026-07-28	Unknown Atlassian Refresh token rotation for public clients Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Atlassian Resource indicators honoured Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unsupported Atlassian No offline_access in advertised scopes Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.atlassian.com/.well-known/oauth-protected-resource/v2/mcp — HTTP 200; scopes_supported includes offline_access: [read:me, read:account, offline_access, email, read:jira:agent-interface, write:jira:agent-interface, search:jira:agent-interface, delete:jira:agent-interface, manage:jira:age… Revision 2026-07-28	Unknown Atlassian 401 for missing or invalid tokens Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Atlassian Audience validation Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Atlassian Bearer token only in the Authorization header Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported Atlassian All endpoints served over HTTPS Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://auth.atlassian.com/.well-known/oauth-authorization-server/VCeDsk8ZHncYF1g234fKtc4lNipbBhu3 — HTTP 200; all 6 endpoints use https Revision 2026-07-28	Unknown Atlassian No token passthrough to upstream APIs Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Atlassian Per-client consent on proxy servers Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.
Attio CAccess: publicAuth: oauth	Supported Attio Metadata issuer matches the discovery URL Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://app.attio.com/.well-known/oauth-authorization-server — HTTP 200; issuer: https://app.attio.com equals the issuer the PRM named Revision 2026-07-28	Supported Attio Authorization server metadata discoverable Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://app.attio.com/.well-known/oauth-authorization-server — HTTP 200; issuer: https://app.attio.com Revision 2026-07-28	Supported Attio Protected Resource Metadata served Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.attio.com/.well-known/oauth-protected-resource/mcp — HTTP 200; resource: https://mcp.attio.com/mcp Revision 2026-07-28	Supported Attio PRM lists an authorization server Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.attio.com/.well-known/oauth-protected-resource/mcp — HTTP 200; authorization_servers: [https://app.attio.com] Revision 2026-07-28	Supported Attio PRM lists scopes_supported Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.attio.com/.well-known/oauth-protected-resource/mcp — HTTP 200; scopes_supported: [mcp, offline_access, openid] Revision 2026-07-28	Supported Attio PRM reachable at a well-known URI Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.attio.com/.well-known/oauth-protected-resource/mcp — HTTP 200; found at the path-aware location Revision 2026-07-28	Supported Attio resource_metadata in the 401 challenge Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.attio.com/mcp — HTTP 401; WWW-Authenticate resource_metadata: https://mcp.attio.com/.well-known/oauth-protected-resource Revision 2026-07-28	Unsupported Attio Client ID Metadata Documents supported Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://app.attio.com/.well-known/oauth-authorization-server — HTTP 200; client_id_metadata_document_supported: absent Revision 2026-07-28	Supported Attio Dynamic Client Registration offered Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://app.attio.com/.well-known/oauth-authorization-server — HTTP 200; registration_endpoint: https://app.attio.com/oauth/register Revision 2026-07-28	Unknown Attio Documented pre-registration path Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unsupported Attio Issuer identifier in authorization responses Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://app.attio.com/.well-known/oauth-authorization-server — HTTP 200; authorization_response_iss_parameter_supported: absent Revision 2026-07-28	Supported Attio PKCE with S256 advertised Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://app.attio.com/.well-known/oauth-authorization-server — HTTP 200; code_challenge_methods_supported: [S256] Revision 2026-07-28	Unknown Attio 403 insufficient_scope for step-up Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported Attio Scope in the WWW-Authenticate challenge Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.attio.com/mcp — HTTP 401; WWW-Authenticate scope: [openid, offline_access, mcp] Revision 2026-07-28	Unknown Attio Refresh token rotation for public clients Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Attio Resource indicators honoured Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unsupported Attio No offline_access in advertised scopes Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.attio.com/.well-known/oauth-protected-resource/mcp — HTTP 200; scopes_supported includes offline_access: [mcp, offline_access, openid] Revision 2026-07-28	Unknown Attio 401 for missing or invalid tokens Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Attio Audience validation Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Attio Bearer token only in the Authorization header Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported Attio All endpoints served over HTTPS Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://app.attio.com/.well-known/oauth-authorization-server — HTTP 200; all 5 endpoints use https Revision 2026-07-28	Unknown Attio No token passthrough to upstream APIs Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Attio Per-client consent on proxy servers Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.
AWS Knowledge No OAuthAccess: publicAuth: no authentication	Not applicable AWS Knowledge Metadata issuer matches the discovery URL Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable AWS Knowledge Authorization server metadata discoverable Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable AWS Knowledge Protected Resource Metadata served Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable AWS Knowledge PRM lists an authorization server Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable AWS Knowledge PRM lists scopes_supported Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable AWS Knowledge PRM reachable at a well-known URI Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable AWS Knowledge resource_metadata in the 401 challenge Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable AWS Knowledge Client ID Metadata Documents supported Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable AWS Knowledge Dynamic Client Registration offered Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable AWS Knowledge Documented pre-registration path Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable AWS Knowledge Issuer identifier in authorization responses Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable AWS Knowledge PKCE with S256 advertised Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable AWS Knowledge 403 insufficient_scope for step-up Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable AWS Knowledge Scope in the WWW-Authenticate challenge Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable AWS Knowledge Refresh token rotation for public clients Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable AWS Knowledge Resource indicators honoured Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable AWS Knowledge No offline_access in advertised scopes Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable AWS Knowledge 401 for missing or invalid tokens Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable AWS Knowledge Audience validation Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable AWS Knowledge Bearer token only in the Authorization header Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable AWS Knowledge All endpoints served over HTTPS Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable AWS Knowledge No token passthrough to upstream APIs Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable AWS Knowledge Per-client consent on proxy servers Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28
Box CAccess: closedAuth: oauth	Supported Box Metadata issuer matches the discovery URL Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://api.box.com/.well-known/oauth-authorization-server — HTTP 200; issuer: https://api.box.com equals the issuer the PRM named Revision 2026-07-28	Supported Box Authorization server metadata discoverable Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://api.box.com/.well-known/oauth-authorization-server — HTTP 200; issuer: https://api.box.com Revision 2026-07-28	Supported Box Protected Resource Metadata served Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.box.com/.well-known/oauth-protected-resource — HTTP 200; resource: https://mcp.box.com/ Revision 2026-07-28	Supported Box PRM lists an authorization server Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.box.com/.well-known/oauth-protected-resource — HTTP 200; authorization_servers: [https://api.box.com/] Revision 2026-07-28	Unsupported Box PRM lists scopes_supported Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.box.com/.well-known/oauth-protected-resource — HTTP 200; scopes_supported: absent Revision 2026-07-28	Supported Box PRM reachable at a well-known URI Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.box.com/.well-known/oauth-protected-resource — HTTP 200; found at the root location Revision 2026-07-28	Supported Box resource_metadata in the 401 challenge Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.box.com/ — HTTP 401; WWW-Authenticate resource_metadata: https://mcp.box.com/.well-known/oauth-protected-resource Revision 2026-07-28	Unsupported Box Client ID Metadata Documents supported Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://api.box.com/.well-known/oauth-authorization-server — HTTP 200; client_id_metadata_document_supported: absent Revision 2026-07-28	Unsupported Box Dynamic Client Registration offered Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://api.box.com/.well-known/oauth-authorization-server — HTTP 200; registration_endpoint: absent Revision 2026-07-28	Supported Box Documented pre-registration path Supported Method vendor-claim Observed 2026-10-14 by jbspeakr (documentation pass with Claude Code) Evidence https://developer.box.com/guides/box-mcp/remote/ — "Enter the Redirect URI provided by the external MCP client. [...] Copy the generated Client ID and Client Secret." (Credentials are created under Admin Console > Integrations > Box MCP server > Configure > Add Integration Credentials; the README also allows creating your own OAuth app in the Developer Console.) Revision 2026-07-28	Unsupported Box Issuer identifier in authorization responses Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://api.box.com/.well-known/oauth-authorization-server — HTTP 200; authorization_response_iss_parameter_supported: absent Revision 2026-07-28	Supported Box PKCE with S256 advertised Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://api.box.com/.well-known/oauth-authorization-server — HTTP 200; code_challenge_methods_supported: [S256] Revision 2026-07-28	Unknown Box 403 insufficient_scope for step-up Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unsupported Box Scope in the WWW-Authenticate challenge Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.box.com/ — HTTP 401; WWW-Authenticate: Bearer realm="Service", error="invalid_request", error_description="The access token was not found.", resource_metadata="https://mcp.box.com/.well-known/oauth-protected-resource", no scope parameter Revision 2026-07-28	Unknown Box Refresh token rotation for public clients Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Box Resource indicators honoured Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Box No offline_access in advertised scopes Unknown Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.box.com/.well-known/oauth-protected-resource — HTTP 200; scopes_supported: absent, so no scope is advertised to judge Revision 2026-07-28	Unknown Box 401 for missing or invalid tokens Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Box Audience validation Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Box Bearer token only in the Authorization header Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported Box All endpoints served over HTTPS Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://api.box.com/.well-known/oauth-authorization-server — HTTP 200; all 3 endpoints use https Revision 2026-07-28	Unknown Box No token passthrough to upstream APIs Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Box Per-client consent on proxy servers Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.
Buildkite CAccess: publicAuth: oauth	Supported Buildkite Metadata issuer matches the discovery URL Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.buildkite.com/.well-known/oauth-authorization-server — HTTP 200; issuer: https://mcp.buildkite.com equals the issuer the PRM named Revision 2026-07-28	Supported Buildkite Authorization server metadata discoverable Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.buildkite.com/.well-known/oauth-authorization-server — HTTP 200; issuer: https://mcp.buildkite.com Revision 2026-07-28	Supported Buildkite Protected Resource Metadata served Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.buildkite.com/.well-known/oauth-protected-resource/mcp — HTTP 200; resource: https://mcp.buildkite.com/mcp Revision 2026-07-28	Supported Buildkite PRM lists an authorization server Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.buildkite.com/.well-known/oauth-protected-resource/mcp — HTTP 200; authorization_servers: [https://mcp.buildkite.com] Revision 2026-07-28	Unsupported Buildkite PRM lists scopes_supported Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.buildkite.com/.well-known/oauth-protected-resource/mcp — HTTP 200; scopes_supported: absent Revision 2026-07-28	Supported Buildkite PRM reachable at a well-known URI Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.buildkite.com/.well-known/oauth-protected-resource/mcp — HTTP 200; found at the path-aware location Revision 2026-07-28	Supported Buildkite resource_metadata in the 401 challenge Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.buildkite.com/mcp — HTTP 401; WWW-Authenticate resource_metadata: https://mcp.buildkite.com/.well-known/oauth-protected-resource/mcp Revision 2026-07-28	Unsupported Buildkite Client ID Metadata Documents supported Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.buildkite.com/.well-known/oauth-authorization-server — HTTP 200; client_id_metadata_document_supported: absent Revision 2026-07-28	Supported Buildkite Dynamic Client Registration offered Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.buildkite.com/.well-known/oauth-authorization-server — HTTP 200; registration_endpoint: https://mcp.buildkite.com/oauth/register Revision 2026-07-28	Unknown Buildkite Documented pre-registration path Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unsupported Buildkite Issuer identifier in authorization responses Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.buildkite.com/.well-known/oauth-authorization-server — HTTP 200; authorization_response_iss_parameter_supported: absent Revision 2026-07-28	Supported Buildkite PKCE with S256 advertised Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.buildkite.com/.well-known/oauth-authorization-server — HTTP 200; code_challenge_methods_supported: [S256] Revision 2026-07-28	Unknown Buildkite 403 insufficient_scope for step-up Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unsupported Buildkite Scope in the WWW-Authenticate challenge Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.buildkite.com/mcp — HTTP 401; WWW-Authenticate: Bearer realm="https://mcp.buildkite.com", error="access_denied", error_description="Authentication required", resource_metadata="https://mcp.buildkite.com/.well-known/oauth-protected-resource/mcp", no scope parameter Revision 2026-07-28	Unknown Buildkite Refresh token rotation for public clients Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Buildkite Resource indicators honoured Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported Buildkite No offline_access in advertised scopes Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.buildkite.com/.well-known/oauth-authorization-server — HTTP 200; the authorization server's scopes_supported has no offline_access: [read, write]; the server advertises no scopes of its own Revision 2026-07-28	Unknown Buildkite 401 for missing or invalid tokens Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Buildkite Audience validation Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Buildkite Bearer token only in the Authorization header Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported Buildkite All endpoints served over HTTPS Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.buildkite.com/.well-known/oauth-authorization-server — HTTP 200; all 3 endpoints use https Revision 2026-07-28	Unknown Buildkite No token passthrough to upstream APIs Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Buildkite Per-client consent on proxy servers Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.
Canva CAccess: publicAuth: oauth	Supported Canva Metadata issuer matches the discovery URL Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.canva.com/.well-known/oauth-authorization-server — HTTP 200; issuer: https://mcp.canva.com equals the issuer the PRM named Revision 2026-07-28	Supported Canva Authorization server metadata discoverable Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.canva.com/.well-known/oauth-authorization-server — HTTP 200; issuer: https://mcp.canva.com Revision 2026-07-28	Supported Canva Protected Resource Metadata served Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.canva.com/.well-known/oauth-protected-resource/mcp — HTTP 200; resource: https://mcp.canva.com/mcp Revision 2026-07-28	Supported Canva PRM lists an authorization server Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.canva.com/.well-known/oauth-protected-resource/mcp — HTTP 200; authorization_servers: [https://mcp.canva.com] Revision 2026-07-28	Supported Canva PRM lists scopes_supported Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.canva.com/.well-known/oauth-protected-resource/mcp — HTTP 200; scopes_supported: [profile:read, design:meta:read, design:content:write, design:content:read, folder:read, folder:write, brandtemplate:content:read, brandtemplate:meta:read, brandtemplate:content:write, comment:write, commen… Revision 2026-07-28	Supported Canva PRM reachable at a well-known URI Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.canva.com/.well-known/oauth-protected-resource/mcp — HTTP 200; found at the path-aware location Revision 2026-07-28	Supported Canva resource_metadata in the 401 challenge Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.canva.com/mcp — HTTP 401; WWW-Authenticate resource_metadata: https://mcp.canva.com/.well-known/oauth-protected-resource/mcp Revision 2026-07-28	Supported Canva Client ID Metadata Documents supported Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.canva.com/.well-known/oauth-authorization-server — HTTP 200; client_id_metadata_document_supported: true Revision 2026-07-28	Supported Canva Dynamic Client Registration offered Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.canva.com/.well-known/oauth-authorization-server — HTTP 200; registration_endpoint: https://mcp.canva.com/register Revision 2026-07-28	Supported Canva Documented pre-registration path Supported Method vendor-claim Observed 2026-10-14 by jbspeakr (documentation pass with Claude Code) Evidence https://www.canva.dev/docs/apps/quickstart/ — "You get a client ID and client secret straight away, and you manage your own redirect URLs." (App created in the Canva Developer Portal with 'Canva MCP' turned on; such clients use https://api.canva.com/connect/v1/mcp per the quickstart.) Revision 2026-07-28	Unsupported Canva Issuer identifier in authorization responses Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.canva.com/.well-known/oauth-authorization-server — HTTP 200; authorization_response_iss_parameter_supported: absent Revision 2026-07-28	Supported Canva PKCE with S256 advertised Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.canva.com/.well-known/oauth-authorization-server — HTTP 200; code_challenge_methods_supported: [plain, S256] Revision 2026-07-28	Unknown Canva 403 insufficient_scope for step-up Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unsupported Canva Scope in the WWW-Authenticate challenge Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.canva.com/mcp — HTTP 401; WWW-Authenticate: Bearer realm="OAuth", resource_metadata="https://mcp.canva.com/.well-known/oauth-protected-resource/mcp", error="invalid_token", error_description="Missing or invalid access token", no scope parameter Revision 2026-07-28	Unknown Canva Refresh token rotation for public clients Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Canva Resource indicators honoured Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported Canva No offline_access in advertised scopes Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.canva.com/.well-known/oauth-protected-resource/mcp — HTTP 200; scopes_supported without offline_access: [profile:read, design:meta:read, design:content:write, design:content:read, folder:read, folder:write, brandtemplate:content:read, brandtemplate:meta:read, brandtemplate:content:write… Revision 2026-07-28	Unknown Canva 401 for missing or invalid tokens Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Canva Audience validation Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Canva Bearer token only in the Authorization header Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported Canva All endpoints served over HTTPS Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.canva.com/.well-known/oauth-authorization-server — HTTP 200; all 4 endpoints use https Revision 2026-07-28	Unknown Canva No token passthrough to upstream APIs Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Canva Per-client consent on proxy servers Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.
ClickUp CAccess: publicAuth: oauth	Supported ClickUp Metadata issuer matches the discovery URL Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.clickup.com/.well-known/oauth-authorization-server — HTTP 200; issuer: https://mcp.clickup.com equals the issuer the PRM named Revision 2026-07-28	Supported ClickUp Authorization server metadata discoverable Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.clickup.com/.well-known/oauth-authorization-server — HTTP 200; issuer: https://mcp.clickup.com Revision 2026-07-28	Supported ClickUp Protected Resource Metadata served Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.clickup.com/.well-known/oauth-protected-resource/mcp — HTTP 200; resource: https://mcp.clickup.com/mcp Revision 2026-07-28	Supported ClickUp PRM lists an authorization server Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.clickup.com/.well-known/oauth-protected-resource/mcp — HTTP 200; authorization_servers: [https://mcp.clickup.com] Revision 2026-07-28	Supported ClickUp PRM lists scopes_supported Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.clickup.com/.well-known/oauth-protected-resource/mcp — HTTP 200; scopes_supported: [read, write] Revision 2026-07-28	Supported ClickUp PRM reachable at a well-known URI Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.clickup.com/.well-known/oauth-protected-resource/mcp — HTTP 200; found at the path-aware location Revision 2026-07-28	Supported ClickUp resource_metadata in the 401 challenge Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.clickup.com/mcp — HTTP 401; WWW-Authenticate resource_metadata: https://mcp.clickup.com/.well-known/oauth-protected-resource/mcp Revision 2026-07-28	Unsupported ClickUp Client ID Metadata Documents supported Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.clickup.com/.well-known/oauth-authorization-server — HTTP 200; client_id_metadata_document_supported: absent Revision 2026-07-28	Supported ClickUp Dynamic Client Registration offered Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.clickup.com/.well-known/oauth-authorization-server — HTTP 200; registration_endpoint: https://mcp.clickup.com/oauth/register Revision 2026-07-28	Unknown ClickUp Documented pre-registration path Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported ClickUp Issuer identifier in authorization responses Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.clickup.com/.well-known/oauth-authorization-server — HTTP 200; authorization_response_iss_parameter_supported: true Revision 2026-07-28	Supported ClickUp PKCE with S256 advertised Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.clickup.com/.well-known/oauth-authorization-server — HTTP 200; code_challenge_methods_supported: [S256] Revision 2026-07-28	Unknown ClickUp 403 insufficient_scope for step-up Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unsupported ClickUp Scope in the WWW-Authenticate challenge Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.clickup.com/mcp — HTTP 401; WWW-Authenticate: Bearer realm="MCP Server", error="invalid_token", error_description="Bearer token required", resource_metadata="https://mcp.clickup.com/.well-known/oauth-protected-resource/mcp", no scope parameter Revision 2026-07-28	Unknown ClickUp Refresh token rotation for public clients Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown ClickUp Resource indicators honoured Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported ClickUp No offline_access in advertised scopes Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.clickup.com/.well-known/oauth-protected-resource/mcp — HTTP 200; scopes_supported without offline_access: [read, write] Revision 2026-07-28	Unknown ClickUp 401 for missing or invalid tokens Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown ClickUp Audience validation Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown ClickUp Bearer token only in the Authorization header Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported ClickUp All endpoints served over HTTPS Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.clickup.com/.well-known/oauth-authorization-server — HTTP 200; all 3 endpoints use https Revision 2026-07-28	Unknown ClickUp No token passthrough to upstream APIs Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown ClickUp Per-client consent on proxy servers Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.
Cloudflare Workers CAccess: publicAuth: oauth	Supported Cloudflare Workers Metadata issuer matches the discovery URL Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://bindings.mcp.cloudflare.com/.well-known/oauth-authorization-server — HTTP 200; issuer: https://bindings.mcp.cloudflare.com equals the issuer the PRM named Revision 2026-07-28	Supported Cloudflare Workers Authorization server metadata discoverable Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://bindings.mcp.cloudflare.com/.well-known/oauth-authorization-server — HTTP 200; issuer: https://bindings.mcp.cloudflare.com Revision 2026-07-28	Supported Cloudflare Workers Protected Resource Metadata served Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://bindings.mcp.cloudflare.com/.well-known/oauth-protected-resource/mcp — HTTP 200; resource: https://bindings.mcp.cloudflare.com/mcp Revision 2026-07-28	Supported Cloudflare Workers PRM lists an authorization server Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://bindings.mcp.cloudflare.com/.well-known/oauth-protected-resource/mcp — HTTP 200; authorization_servers: [https://bindings.mcp.cloudflare.com] Revision 2026-07-28	Unsupported Cloudflare Workers PRM lists scopes_supported Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://bindings.mcp.cloudflare.com/.well-known/oauth-protected-resource/mcp — HTTP 200; scopes_supported: absent Revision 2026-07-28	Supported Cloudflare Workers PRM reachable at a well-known URI Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://bindings.mcp.cloudflare.com/.well-known/oauth-protected-resource/mcp — HTTP 200; found at the path-aware location Revision 2026-07-28	Supported Cloudflare Workers resource_metadata in the 401 challenge Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://bindings.mcp.cloudflare.com/mcp — HTTP 401; WWW-Authenticate resource_metadata: https://bindings.mcp.cloudflare.com/.well-known/oauth-protected-resource/mcp Revision 2026-07-28	Unsupported Cloudflare Workers Client ID Metadata Documents supported Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://bindings.mcp.cloudflare.com/.well-known/oauth-authorization-server — HTTP 200; client_id_metadata_document_supported: false Revision 2026-07-28	Supported Cloudflare Workers Dynamic Client Registration offered Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://bindings.mcp.cloudflare.com/.well-known/oauth-authorization-server — HTTP 200; registration_endpoint: https://bindings.mcp.cloudflare.com/register Revision 2026-07-28	Unknown Cloudflare Workers Documented pre-registration path Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported Cloudflare Workers Issuer identifier in authorization responses Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://bindings.mcp.cloudflare.com/.well-known/oauth-authorization-server — HTTP 200; authorization_response_iss_parameter_supported: true Revision 2026-07-28	Supported Cloudflare Workers PKCE with S256 advertised Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://bindings.mcp.cloudflare.com/.well-known/oauth-authorization-server — HTTP 200; code_challenge_methods_supported: [S256] Revision 2026-07-28	Unknown Cloudflare Workers 403 insufficient_scope for step-up Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unsupported Cloudflare Workers Scope in the WWW-Authenticate challenge Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://bindings.mcp.cloudflare.com/mcp — HTTP 401; WWW-Authenticate: Bearer realm="OAuth", resource_metadata="https://bindings.mcp.cloudflare.com/.well-known/oauth-protected-resource/mcp", no scope parameter Revision 2026-07-28	Unknown Cloudflare Workers Refresh token rotation for public clients Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Cloudflare Workers Resource indicators honoured Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Cloudflare Workers No offline_access in advertised scopes Unknown Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://bindings.mcp.cloudflare.com/.well-known/oauth-protected-resource/mcp — HTTP 200; scopes_supported: absent, so no scope is advertised to judge Revision 2026-07-28	Unknown Cloudflare Workers 401 for missing or invalid tokens Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Cloudflare Workers Audience validation Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Cloudflare Workers Bearer token only in the Authorization header Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported Cloudflare Workers All endpoints served over HTTPS Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://bindings.mcp.cloudflare.com/.well-known/oauth-authorization-server — HTTP 200; all 4 endpoints use https Revision 2026-07-28	Unknown Cloudflare Workers No token passthrough to upstream APIs Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Cloudflare Workers Per-client consent on proxy servers Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.
Cloudinary CAccess: publicAuth: oauth	Supported Cloudinary Metadata issuer matches the discovery URL Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://asset-management.mcp.cloudinary.com/.well-known/oauth-authorization-server — HTTP 200; issuer: https://asset-management.mcp.cloudinary.com equals the issuer the PRM named Revision 2026-07-28	Supported Cloudinary Authorization server metadata discoverable Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://asset-management.mcp.cloudinary.com/.well-known/oauth-authorization-server — HTTP 200; issuer: https://asset-management.mcp.cloudinary.com Revision 2026-07-28	Supported Cloudinary Protected Resource Metadata served Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://asset-management.mcp.cloudinary.com/.well-known/oauth-protected-resource/sse — HTTP 200; resource: https://asset-management.mcp.cloudinary.com/sse Revision 2026-07-28	Supported Cloudinary PRM lists an authorization server Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://asset-management.mcp.cloudinary.com/.well-known/oauth-protected-resource/sse — HTTP 200; authorization_servers: [https://asset-management.mcp.cloudinary.com] Revision 2026-07-28	Supported Cloudinary PRM lists scopes_supported Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://asset-management.mcp.cloudinary.com/.well-known/oauth-protected-resource/sse — HTTP 200; scopes_supported: [openid, profile, email, offline_access, asset_management, upload, media_generation] Revision 2026-07-28	Supported Cloudinary PRM reachable at a well-known URI Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://asset-management.mcp.cloudinary.com/.well-known/oauth-protected-resource/sse — HTTP 200; found at the path-aware location Revision 2026-07-28	Supported Cloudinary resource_metadata in the 401 challenge Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://asset-management.mcp.cloudinary.com/sse — HTTP 401; WWW-Authenticate resource_metadata: https://asset-management.mcp.cloudinary.com/.well-known/oauth-protected-resource Revision 2026-07-28	Unsupported Cloudinary Client ID Metadata Documents supported Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://asset-management.mcp.cloudinary.com/.well-known/oauth-authorization-server — HTTP 200; client_id_metadata_document_supported: absent Revision 2026-07-28	Supported Cloudinary Dynamic Client Registration offered Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://asset-management.mcp.cloudinary.com/.well-known/oauth-authorization-server — HTTP 200; registration_endpoint: https://asset-management.mcp.cloudinary.com/register Revision 2026-07-28	Unknown Cloudinary Documented pre-registration path Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unsupported Cloudinary Issuer identifier in authorization responses Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://asset-management.mcp.cloudinary.com/.well-known/oauth-authorization-server — HTTP 200; authorization_response_iss_parameter_supported: absent Revision 2026-07-28	Supported Cloudinary PKCE with S256 advertised Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://asset-management.mcp.cloudinary.com/.well-known/oauth-authorization-server — HTTP 200; code_challenge_methods_supported: [S256, plain] Revision 2026-07-28	Unknown Cloudinary 403 insufficient_scope for step-up Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported Cloudinary Scope in the WWW-Authenticate challenge Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://asset-management.mcp.cloudinary.com/sse — HTTP 401; WWW-Authenticate scope: [openid, profile, email, offline_access, asset_management, upload, media_generation] Revision 2026-07-28	Unknown Cloudinary Refresh token rotation for public clients Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Cloudinary Resource indicators honoured Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unsupported Cloudinary No offline_access in advertised scopes Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://asset-management.mcp.cloudinary.com/.well-known/oauth-protected-resource/sse — HTTP 200; scopes_supported includes offline_access: [openid, profile, email, offline_access, asset_management, upload, media_generation] Revision 2026-07-28	Unknown Cloudinary 401 for missing or invalid tokens Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Cloudinary Audience validation Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Cloudinary Bearer token only in the Authorization header Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported Cloudinary All endpoints served over HTTPS Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://asset-management.mcp.cloudinary.com/.well-known/oauth-authorization-server — HTTP 200; all 4 endpoints use https Revision 2026-07-28	Unknown Cloudinary No token passthrough to upstream APIs Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Cloudinary Per-client consent on proxy servers Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.
DeepWiki No OAuthAccess: publicAuth: no authentication	Not applicable DeepWiki Metadata issuer matches the discovery URL Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable DeepWiki Authorization server metadata discoverable Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable DeepWiki Protected Resource Metadata served Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable DeepWiki PRM lists an authorization server Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable DeepWiki PRM lists scopes_supported Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable DeepWiki PRM reachable at a well-known URI Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable DeepWiki resource_metadata in the 401 challenge Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable DeepWiki Client ID Metadata Documents supported Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable DeepWiki Dynamic Client Registration offered Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable DeepWiki Documented pre-registration path Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable DeepWiki Issuer identifier in authorization responses Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable DeepWiki PKCE with S256 advertised Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable DeepWiki 403 insufficient_scope for step-up Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable DeepWiki Scope in the WWW-Authenticate challenge Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable DeepWiki Refresh token rotation for public clients Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable DeepWiki Resource indicators honoured Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable DeepWiki No offline_access in advertised scopes Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable DeepWiki 401 for missing or invalid tokens Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable DeepWiki Audience validation Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable DeepWiki Bearer token only in the Authorization header Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable DeepWiki All endpoints served over HTTPS Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable DeepWiki No token passthrough to upstream APIs Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable DeepWiki Per-client consent on proxy servers Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28
Figma CAccess: publicAuth: oauth	Supported Figma Metadata issuer matches the discovery URL Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://api.figma.com/.well-known/oauth-authorization-server — HTTP 200; issuer: https://api.figma.com equals the issuer the PRM named Revision 2026-07-28	Supported Figma Authorization server metadata discoverable Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://api.figma.com/.well-known/oauth-authorization-server — HTTP 200; issuer: https://api.figma.com Revision 2026-07-28	Supported Figma Protected Resource Metadata served Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.figma.com/.well-known/oauth-protected-resource/mcp — HTTP 200; resource: https://mcp.figma.com/mcp Revision 2026-07-28	Supported Figma PRM lists an authorization server Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.figma.com/.well-known/oauth-protected-resource/mcp — HTTP 200; authorization_servers: [https://api.figma.com] Revision 2026-07-28	Supported Figma PRM lists scopes_supported Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.figma.com/.well-known/oauth-protected-resource/mcp — HTTP 200; scopes_supported: [mcp:connect] Revision 2026-07-28	Supported Figma PRM reachable at a well-known URI Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.figma.com/.well-known/oauth-protected-resource/mcp — HTTP 200; found at the path-aware location Revision 2026-07-28	Unknown Figma resource_metadata in the 401 challenge Unknown Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.figma.com/mcp — HTTP 400; no 401 challenge to an unauthenticated request (GET HTTP 405, POST HTTP 400), nothing to judge Revision 2026-07-28	Unsupported Figma Client ID Metadata Documents supported Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://api.figma.com/.well-known/oauth-authorization-server — HTTP 200; client_id_metadata_document_supported: absent Revision 2026-07-28	Supported Figma Dynamic Client Registration offered Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://api.figma.com/.well-known/oauth-authorization-server — HTTP 200; registration_endpoint: https://api.figma.com/v1/oauth/mcp/register Revision 2026-07-28	Partial Figma Documented pre-registration path Partial Method vendor-claim Observed 2026-10-14 by jbspeakr (documentation pass with Claude Code) Evidence https://developers.figma.com/docs/figma-mcp-server/rate-limits-access/ — "Only clients listed in the Figma MCP Catalog are able to connect to the Figma MCP Server. If you're a developer interested in connecting a new MCP client, you can join the waitlist." (The only documented path for a new client is a waitlist; no self-service way to obtain client credentials is described.) Revision 2026-07-28	Supported Figma Issuer identifier in authorization responses Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://api.figma.com/.well-known/oauth-authorization-server — HTTP 200; authorization_response_iss_parameter_supported: true Revision 2026-07-28	Supported Figma PKCE with S256 advertised Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://api.figma.com/.well-known/oauth-authorization-server — HTTP 200; code_challenge_methods_supported: [S256] Revision 2026-07-28	Unknown Figma 403 insufficient_scope for step-up Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Figma Scope in the WWW-Authenticate challenge Unknown Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.figma.com/mcp — HTTP 400; no 401 challenge to an unauthenticated request (GET HTTP 405, POST HTTP 400), nothing to judge Revision 2026-07-28	Unknown Figma Refresh token rotation for public clients Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Figma Resource indicators honoured Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported Figma No offline_access in advertised scopes Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.figma.com/.well-known/oauth-protected-resource/mcp — HTTP 200; scopes_supported without offline_access: [mcp:connect] Revision 2026-07-28	Unknown Figma 401 for missing or invalid tokens Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Figma Audience validation Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Figma Bearer token only in the Authorization header Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported Figma All endpoints served over HTTPS Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://api.figma.com/.well-known/oauth-authorization-server — HTTP 200; all 3 endpoints use https Revision 2026-07-28	Unknown Figma No token passthrough to upstream APIs Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Figma Per-client consent on proxy servers Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.
GitHub CAccess: publicAuth: oauth	Supported GitHub Metadata issuer matches the discovery URL Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://github.com/.well-known/oauth-authorization-server/login/oauth — HTTP 200; issuer: https://github.com/login/oauth equals the issuer the PRM named Revision 2026-07-28	Supported GitHub Authorization server metadata discoverable Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://github.com/.well-known/oauth-authorization-server/login/oauth — HTTP 200; issuer: https://github.com/login/oauth Revision 2026-07-28	Supported GitHub Protected Resource Metadata served Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://api.githubcopilot.com/.well-known/oauth-protected-resource/mcp — HTTP 200; resource: https://api.githubcopilot.com/mcp Revision 2026-07-28	Supported GitHub PRM lists an authorization server Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://api.githubcopilot.com/.well-known/oauth-protected-resource/mcp — HTTP 200; authorization_servers: [https://github.com/login/oauth] Revision 2026-07-28	Supported GitHub PRM lists scopes_supported Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://api.githubcopilot.com/.well-known/oauth-protected-resource/mcp — HTTP 200; scopes_supported: [repo, read:org, read:user, user:email, read:packages, write:packages, read:project, project, gist, notifications] Revision 2026-07-28	Supported GitHub PRM reachable at a well-known URI Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://api.githubcopilot.com/.well-known/oauth-protected-resource/mcp — HTTP 200; found at the path-aware location Revision 2026-07-28	Supported GitHub resource_metadata in the 401 challenge Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://api.githubcopilot.com/mcp — HTTP 401; WWW-Authenticate resource_metadata: https://api.githubcopilot.com/.well-known/oauth-protected-resource/mcp Revision 2026-07-28	Unsupported GitHub Client ID Metadata Documents supported Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://github.com/.well-known/oauth-authorization-server/login/oauth — HTTP 200; client_id_metadata_document_supported: absent Revision 2026-07-28	Unsupported GitHub Dynamic Client Registration offered Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://github.com/.well-known/oauth-authorization-server/login/oauth — HTTP 200; registration_endpoint: absent Revision 2026-07-28	Supported GitHub Documented pre-registration path Supported Method vendor-claim Observed 2026-10-14 by jbspeakr (documentation pass with Claude Code) Evidence https://github.com/github/github-mcp-server — "Each MCP host application needs to configure a GitHub App or OAuth App to support remote access via OAuth. Any host application that supports remote MCP servers should support the remote GitHub server with PAT authentication." (Pre-registration is per host application via a GitHub App or OAuth App; PAT bearer auth is the fallback for unregistered hosts.) Revision 2026-07-28	Supported GitHub Issuer identifier in authorization responses Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://github.com/.well-known/oauth-authorization-server/login/oauth — HTTP 200; authorization_response_iss_parameter_supported: true Revision 2026-07-28	Supported GitHub PKCE with S256 advertised Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://github.com/.well-known/oauth-authorization-server/login/oauth — HTTP 200; code_challenge_methods_supported: [S256] Revision 2026-07-28	Unknown GitHub 403 insufficient_scope for step-up Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unsupported GitHub Scope in the WWW-Authenticate challenge Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://api.githubcopilot.com/mcp — HTTP 401; WWW-Authenticate: Bearer error="invalid_request", error_description="No access token was provided in this request", resource_metadata="https://api.githubcopilot.com/.well-known/oauth-protected-resource/mcp", no scope parameter Revision 2026-07-28	Unknown GitHub Refresh token rotation for public clients Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown GitHub Resource indicators honoured Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported GitHub No offline_access in advertised scopes Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://api.githubcopilot.com/.well-known/oauth-protected-resource/mcp — HTTP 200; scopes_supported without offline_access: [repo, read:org, read:user, user:email, read:packages, write:packages, read:project, project, gist, notifications] Revision 2026-07-28	Unknown GitHub 401 for missing or invalid tokens Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown GitHub Audience validation Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown GitHub Bearer token only in the Authorization header Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported GitHub All endpoints served over HTTPS Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://github.com/.well-known/oauth-authorization-server/login/oauth — HTTP 200; all 3 endpoints use https Revision 2026-07-28	Unknown GitHub No token passthrough to upstream APIs Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown GitHub Per-client consent on proxy servers Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.
HubSpot CAccess: publicAuth: unknown	Supported HubSpot Metadata issuer matches the discovery URL Supported Method passive-scan Observed 2026-10-18 by scanner@0.3.0 Evidence https://mcp.hubspot.com/.well-known/oauth-authorization-server — HTTP 200; issuer: https://mcp.hubspot.com equals the issuer the PRM named Revision 2026-07-28	Supported HubSpot Authorization server metadata discoverable Supported Method passive-scan Observed 2026-10-18 by scanner@0.3.0 Evidence https://mcp.hubspot.com/.well-known/oauth-authorization-server — HTTP 200; issuer: https://mcp.hubspot.com Revision 2026-07-28	Supported HubSpot Protected Resource Metadata served Supported Method passive-scan Observed 2026-10-18 by scanner@0.3.0 Evidence https://mcp.hubspot.com/.well-known/oauth-protected-resource — HTTP 200; resource: https://mcp.hubspot.com Revision 2026-07-28	Supported HubSpot PRM lists an authorization server Supported Method passive-scan Observed 2026-10-18 by scanner@0.3.0 Evidence https://mcp.hubspot.com/.well-known/oauth-protected-resource — HTTP 200; authorization_servers: [https://mcp.hubspot.com] Revision 2026-07-28	Unsupported HubSpot PRM lists scopes_supported Unsupported Method passive-scan Observed 2026-10-18 by scanner@0.3.0 Evidence https://mcp.hubspot.com/.well-known/oauth-protected-resource — HTTP 200; scopes_supported: [] Revision 2026-07-28	Unsupported HubSpot PRM reachable at a well-known URI Unsupported Method passive-scan Observed 2026-10-18 by scanner@0.3.0 Evidence https://app.hubspot.com/.well-known/oauth-protected-resource — HTTP 404; not at either well-known location (path-aware HTTP 404, root HTTP 404, root HTTP 200) Revision 2026-07-28	Supported HubSpot resource_metadata in the 401 challenge Supported Method passive-scan Observed 2026-10-18 by scanner@0.3.0 Evidence https://app.hubspot.com/mcp/v1/http — HTTP 401; WWW-Authenticate resource_metadata: https://mcp.hubspot.com/.well-known/oauth-protected-resource Revision 2026-07-28	Unsupported HubSpot Client ID Metadata Documents supported Unsupported Method passive-scan Observed 2026-10-18 by scanner@0.3.0 Evidence https://mcp.hubspot.com/.well-known/oauth-authorization-server — HTTP 200; client_id_metadata_document_supported: absent Revision 2026-07-28	Unsupported HubSpot Dynamic Client Registration offered Unsupported Method passive-scan Observed 2026-10-18 by scanner@0.3.0 Evidence https://mcp.hubspot.com/.well-known/oauth-authorization-server — HTTP 200; registration_endpoint: absent Revision 2026-07-28	Not applicable HubSpot Documented pre-registration path Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as API Key; no OAuth authorization server is involved. Revision 2026-07-28	Unsupported HubSpot Issuer identifier in authorization responses Unsupported Method passive-scan Observed 2026-10-18 by scanner@0.3.0 Evidence https://mcp.hubspot.com/.well-known/oauth-authorization-server — HTTP 200; authorization_response_iss_parameter_supported: absent Revision 2026-07-28	Supported HubSpot PKCE with S256 advertised Supported Method passive-scan Observed 2026-10-18 by scanner@0.3.0 Evidence https://mcp.hubspot.com/.well-known/oauth-authorization-server — HTTP 200; code_challenge_methods_supported: [S256] Revision 2026-07-28	Not applicable HubSpot 403 insufficient_scope for step-up Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as API Key; no OAuth authorization server is involved. Revision 2026-07-28	Unsupported HubSpot Scope in the WWW-Authenticate challenge Unsupported Method passive-scan Observed 2026-10-18 by scanner@0.3.0 Evidence https://app.hubspot.com/mcp/v1/http — HTTP 401; WWW-Authenticate: Bearer resource_metadata="https://mcp.hubspot.com/.well-known/oauth-protected-resource", no scope parameter Revision 2026-07-28	Not applicable HubSpot Refresh token rotation for public clients Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as API Key; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable HubSpot Resource indicators honoured Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as API Key; no OAuth authorization server is involved. Revision 2026-07-28	Supported HubSpot No offline_access in advertised scopes Supported Method passive-scan Observed 2026-10-18 by scanner@0.3.0 Evidence https://mcp.hubspot.com/.well-known/oauth-protected-resource — HTTP 200; scopes_supported without offline_access: [] Revision 2026-07-28	Not applicable HubSpot 401 for missing or invalid tokens Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as API Key; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable HubSpot Audience validation Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as API Key; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable HubSpot Bearer token only in the Authorization header Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as API Key; no OAuth authorization server is involved. Revision 2026-07-28	Supported HubSpot All endpoints served over HTTPS Supported Method passive-scan Observed 2026-10-18 by scanner@0.3.0 Evidence https://mcp.hubspot.com/.well-known/oauth-authorization-server — HTTP 200; all 3 endpoints use https Revision 2026-07-28	Not applicable HubSpot No token passthrough to upstream APIs Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as API Key; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable HubSpot Per-client consent on proxy servers Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as API Key; no OAuth authorization server is involved. Revision 2026-07-28
Hugging Face No OAuthAccess: publicAuth: no authentication	Not applicable Hugging Face Metadata issuer matches the discovery URL Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable Hugging Face Authorization server metadata discoverable Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable Hugging Face Protected Resource Metadata served Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable Hugging Face PRM lists an authorization server Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable Hugging Face PRM lists scopes_supported Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable Hugging Face PRM reachable at a well-known URI Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable Hugging Face resource_metadata in the 401 challenge Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable Hugging Face Client ID Metadata Documents supported Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable Hugging Face Dynamic Client Registration offered Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable Hugging Face Documented pre-registration path Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable Hugging Face Issuer identifier in authorization responses Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable Hugging Face PKCE with S256 advertised Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable Hugging Face 403 insufficient_scope for step-up Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable Hugging Face Scope in the WWW-Authenticate challenge Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable Hugging Face Refresh token rotation for public clients Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable Hugging Face Resource indicators honoured Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable Hugging Face No offline_access in advertised scopes Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable Hugging Face 401 for missing or invalid tokens Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable Hugging Face Audience validation Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable Hugging Face Bearer token only in the Authorization header Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable Hugging Face All endpoints served over HTTPS Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable Hugging Face No token passthrough to upstream APIs Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable Hugging Face Per-client consent on proxy servers Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as Open; no OAuth authorization server is involved. Revision 2026-07-28
Intercom CAccess: publicAuth: oauth	Supported Intercom Metadata issuer matches the discovery URL Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.intercom.com/.well-known/oauth-authorization-server — HTTP 200; issuer: https://mcp.intercom.com equals the issuer the PRM named Revision 2026-07-28	Supported Intercom Authorization server metadata discoverable Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.intercom.com/.well-known/oauth-authorization-server — HTTP 200; issuer: https://mcp.intercom.com Revision 2026-07-28	Supported Intercom Protected Resource Metadata served Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.intercom.com/.well-known/oauth-protected-resource/sse — HTTP 200; resource: https://mcp.intercom.com/sse Revision 2026-07-28	Supported Intercom PRM lists an authorization server Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.intercom.com/.well-known/oauth-protected-resource/sse — HTTP 200; authorization_servers: [https://mcp.intercom.com] Revision 2026-07-28	Supported Intercom PRM lists scopes_supported Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.intercom.com/.well-known/oauth-protected-resource/sse — HTTP 200; scopes_supported: [mcp, operator] Revision 2026-07-28	Supported Intercom PRM reachable at a well-known URI Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.intercom.com/.well-known/oauth-protected-resource/sse — HTTP 200; found at the path-aware location Revision 2026-07-28	Supported Intercom resource_metadata in the 401 challenge Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.intercom.com/sse — HTTP 401; WWW-Authenticate resource_metadata: https://mcp.intercom.com/.well-known/oauth-protected-resource/sse Revision 2026-07-28	Unsupported Intercom Client ID Metadata Documents supported Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.intercom.com/.well-known/oauth-authorization-server — HTTP 200; client_id_metadata_document_supported: absent Revision 2026-07-28	Supported Intercom Dynamic Client Registration offered Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.intercom.com/.well-known/oauth-authorization-server — HTTP 200; registration_endpoint: https://mcp.intercom.com/register Revision 2026-07-28	Unknown Intercom Documented pre-registration path Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unsupported Intercom Issuer identifier in authorization responses Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.intercom.com/.well-known/oauth-authorization-server — HTTP 200; authorization_response_iss_parameter_supported: absent Revision 2026-07-28	Supported Intercom PKCE with S256 advertised Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.intercom.com/.well-known/oauth-authorization-server — HTTP 200; code_challenge_methods_supported: [S256] Revision 2026-07-28	Unknown Intercom 403 insufficient_scope for step-up Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported Intercom Scope in the WWW-Authenticate challenge Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.intercom.com/sse — HTTP 401; WWW-Authenticate scope: [mcp, operator] Revision 2026-07-28	Unknown Intercom Refresh token rotation for public clients Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Intercom Resource indicators honoured Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported Intercom No offline_access in advertised scopes Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.intercom.com/.well-known/oauth-protected-resource/sse — HTTP 200; scopes_supported without offline_access: [mcp, operator] Revision 2026-07-28	Unknown Intercom 401 for missing or invalid tokens Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Intercom Audience validation Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Intercom Bearer token only in the Authorization header Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported Intercom All endpoints served over HTTPS Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.intercom.com/.well-known/oauth-authorization-server — HTTP 200; all 4 endpoints use https Revision 2026-07-28	Unknown Intercom No token passthrough to upstream APIs Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported Intercom Per-client consent on proxy servers Supported Method vendor-claim Observed 2026-10-14 by jbspeakr (documentation pass with Claude Code) Evidence https://developers.intercom.com/docs/guides/mcp — "This names the application asking to connect, lists what it will be able to do in your workspace, and shows its Client ID and the address it redirects to after you approve. [...] This asks you to authorize access for Intercom MCP, the server, rather than for the application." (Two screens: the Intercom MCP consent page for the dynamically registered client, then Intercom's own authorization screen for the MCP server's upstream client. Docs add that the application name is supplied by the application and not verified by Intercom.) Revision 2026-07-28
Linear AAccess: publicAuth: oauth	Supported Linear Metadata issuer matches the discovery URL Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.linear.app/.well-known/oauth-authorization-server — HTTP 200; issuer: https://mcp.linear.app equals the issuer the PRM named Revision 2026-07-28	Supported Linear Authorization server metadata discoverable Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.linear.app/.well-known/oauth-authorization-server — HTTP 200; issuer: https://mcp.linear.app Revision 2026-07-28	Supported Linear Protected Resource Metadata served Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.linear.app/.well-known/oauth-protected-resource/mcp — HTTP 200; resource: https://mcp.linear.app/mcp Revision 2026-07-28	Supported Linear PRM lists an authorization server Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.linear.app/.well-known/oauth-protected-resource/mcp — HTTP 200; authorization_servers: [https://mcp.linear.app] Revision 2026-07-28	Supported Linear PRM lists scopes_supported Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.linear.app/.well-known/oauth-protected-resource/mcp — HTTP 200; scopes_supported: [read, write] Revision 2026-07-28	Supported Linear PRM reachable at a well-known URI Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.linear.app/.well-known/oauth-protected-resource/mcp — HTTP 200; found at the path-aware location Revision 2026-07-28	Supported Linear resource_metadata in the 401 challenge Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.linear.app/mcp — HTTP 401; WWW-Authenticate resource_metadata: https://mcp.linear.app/.well-known/oauth-protected-resource/mcp Revision 2026-07-28	Supported Linear Client ID Metadata Documents supported Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.linear.app/.well-known/oauth-authorization-server — HTTP 200; client_id_metadata_document_supported: true Revision 2026-07-28	Supported Linear Dynamic Client Registration offered Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.linear.app/.well-known/oauth-authorization-server — HTTP 200; registration_endpoint: https://mcp.linear.app/register Revision 2026-07-28	Unknown Linear Documented pre-registration path Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported Linear Issuer identifier in authorization responses Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.linear.app/.well-known/oauth-authorization-server — HTTP 200; authorization_response_iss_parameter_supported: true Revision 2026-07-28	Supported Linear PKCE with S256 advertised Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.linear.app/.well-known/oauth-authorization-server — HTTP 200; code_challenge_methods_supported: [S256] Revision 2026-07-28	Unknown Linear 403 insufficient_scope for step-up Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported Linear Scope in the WWW-Authenticate challenge Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.linear.app/mcp — HTTP 401; WWW-Authenticate scope: [read, write] Revision 2026-07-28	Unknown Linear Refresh token rotation for public clients Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Linear Resource indicators honoured Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported Linear No offline_access in advertised scopes Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.linear.app/.well-known/oauth-protected-resource/mcp — HTTP 200; scopes_supported without offline_access: [read, write] Revision 2026-07-28	Unknown Linear 401 for missing or invalid tokens Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Linear Audience validation Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Linear Bearer token only in the Authorization header Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported Linear All endpoints served over HTTPS Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.linear.app/.well-known/oauth-authorization-server — HTTP 200; all 4 endpoints use https Revision 2026-07-28	Unknown Linear No token passthrough to upstream APIs Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Linear Per-client consent on proxy servers Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.
Miro CAccess: publicAuth: oauth	Supported Miro Metadata issuer matches the discovery URL Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.miro.com/.well-known/oauth-authorization-server — HTTP 200; issuer: https://mcp.miro.com/ equals the issuer the PRM named Revision 2026-07-28	Supported Miro Authorization server metadata discoverable Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.miro.com/.well-known/oauth-authorization-server — HTTP 200; issuer: https://mcp.miro.com/ Revision 2026-07-28	Supported Miro Protected Resource Metadata served Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.miro.com/.well-known/oauth-protected-resource — HTTP 200; resource: https://mcp.miro.com/ Revision 2026-07-28	Supported Miro PRM lists an authorization server Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.miro.com/.well-known/oauth-protected-resource — HTTP 200; authorization_servers: [https://mcp.miro.com/] Revision 2026-07-28	Supported Miro PRM lists scopes_supported Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.miro.com/.well-known/oauth-protected-resource — HTTP 200; scopes_supported: [boards:read, boards:write, openid, email] Revision 2026-07-28	Supported Miro PRM reachable at a well-known URI Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.miro.com/.well-known/oauth-protected-resource — HTTP 200; found at the root location Revision 2026-07-28	Supported Miro resource_metadata in the 401 challenge Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.miro.com/ — HTTP 401; WWW-Authenticate resource_metadata: https://mcp.miro.com/.well-known/oauth-protected-resource Revision 2026-07-28	Unsupported Miro Client ID Metadata Documents supported Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.miro.com/.well-known/oauth-authorization-server — HTTP 200; client_id_metadata_document_supported: absent Revision 2026-07-28	Supported Miro Dynamic Client Registration offered Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.miro.com/.well-known/oauth-authorization-server — HTTP 200; registration_endpoint: https://mcp.miro.com/register Revision 2026-07-28	Unknown Miro Documented pre-registration path Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unsupported Miro Issuer identifier in authorization responses Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.miro.com/.well-known/oauth-authorization-server — HTTP 200; authorization_response_iss_parameter_supported: absent Revision 2026-07-28	Supported Miro PKCE with S256 advertised Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.miro.com/.well-known/oauth-authorization-server — HTTP 200; code_challenge_methods_supported: [S256] Revision 2026-07-28	Unknown Miro 403 insufficient_scope for step-up Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unsupported Miro Scope in the WWW-Authenticate challenge Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.miro.com/ — HTTP 401; WWW-Authenticate: Bearer resource_metadata="https://mcp.miro.com/.well-known/oauth-protected-resource", no scope parameter Revision 2026-07-28	Unknown Miro Refresh token rotation for public clients Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Miro Resource indicators honoured Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported Miro No offline_access in advertised scopes Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.miro.com/.well-known/oauth-protected-resource — HTTP 200; scopes_supported without offline_access: [boards:read, boards:write, openid, email] Revision 2026-07-28	Unknown Miro 401 for missing or invalid tokens Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Miro Audience validation Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Miro Bearer token only in the Authorization header Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported Miro All endpoints served over HTTPS Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.miro.com/.well-known/oauth-authorization-server — HTTP 200; all 3 endpoints use https Revision 2026-07-28	Unknown Miro No token passthrough to upstream APIs Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Miro Per-client consent on proxy servers Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.
monday.com CAccess: publicAuth: oauth	Supported monday.com Metadata issuer matches the discovery URL Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://auth.monday.com/.well-known/oauth-authorization-server/mcp — HTTP 200; issuer: https://auth.monday.com/mcp equals the issuer the PRM named Revision 2026-07-28	Supported monday.com Authorization server metadata discoverable Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://auth.monday.com/.well-known/oauth-authorization-server/mcp — HTTP 200; issuer: https://auth.monday.com/mcp Revision 2026-07-28	Supported monday.com Protected Resource Metadata served Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.monday.com/.well-known/oauth-protected-resource — HTTP 200; resource: https://mcp.monday.com/mcp Revision 2026-07-28	Supported monday.com PRM lists an authorization server Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.monday.com/.well-known/oauth-protected-resource — HTTP 200; authorization_servers: [https://auth.monday.com/mcp] Revision 2026-07-28	Unsupported monday.com PRM lists scopes_supported Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.monday.com/.well-known/oauth-protected-resource — HTTP 200; scopes_supported: absent Revision 2026-07-28	Supported monday.com PRM reachable at a well-known URI Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.monday.com/.well-known/oauth-protected-resource — HTTP 200; found at the root location Revision 2026-07-28	Unsupported monday.com resource_metadata in the 401 challenge Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.monday.com/users/sign_in — HTTP 401; WWW-Authenticate: absent, no resource_metadata parameter Revision 2026-07-28	Supported monday.com Client ID Metadata Documents supported Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://auth.monday.com/.well-known/oauth-authorization-server/mcp — HTTP 200; client_id_metadata_document_supported: true Revision 2026-07-28	Supported monday.com Dynamic Client Registration offered Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://auth.monday.com/.well-known/oauth-authorization-server/mcp — HTTP 200; registration_endpoint: https://auth.monday.com/oauth_ms/oauth/register Revision 2026-07-28	Supported monday.com Documented pre-registration path Supported Method vendor-claim Observed 2026-10-14 by jbspeakr (documentation pass with Claude Code) Evidence https://developer.monday.com/api-reference/docs/control-mcp-access-with-oauth-app — "Scroll down to the App Credentials section and copy your Client ID and Client Secret" (Create a monday app, enable the 'New OAuth flow' toggle, add callback URL, then 'pass the MCP server URL plus your Client ID and Client Secret into your client's OAuth configuration'.) Revision 2026-07-28	Supported monday.com Issuer identifier in authorization responses Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://auth.monday.com/.well-known/oauth-authorization-server/mcp — HTTP 200; authorization_response_iss_parameter_supported: true Revision 2026-07-28	Supported monday.com PKCE with S256 advertised Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://auth.monday.com/.well-known/oauth-authorization-server/mcp — HTTP 200; code_challenge_methods_supported: [S256] Revision 2026-07-28	Unknown monday.com 403 insufficient_scope for step-up Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unsupported monday.com Scope in the WWW-Authenticate challenge Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.monday.com/users/sign_in — HTTP 401; WWW-Authenticate: absent, no scope parameter Revision 2026-07-28	Unknown monday.com Refresh token rotation for public clients Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown monday.com Resource indicators honoured Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown monday.com No offline_access in advertised scopes Unknown Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.monday.com/.well-known/oauth-protected-resource — HTTP 200; scopes_supported: absent, so no scope is advertised to judge Revision 2026-07-28	Unknown monday.com 401 for missing or invalid tokens Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown monday.com Audience validation Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown monday.com Bearer token only in the Authorization header Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported monday.com All endpoints served over HTTPS Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://auth.monday.com/.well-known/oauth-authorization-server/mcp — HTTP 200; all 5 endpoints use https Revision 2026-07-28	Unknown monday.com No token passthrough to upstream APIs Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown monday.com Per-client consent on proxy servers Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.
Neon CAccess: publicAuth: oauth	Supported Neon Metadata issuer matches the discovery URL Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.neon.tech/.well-known/oauth-authorization-server — HTTP 200; issuer: https://mcp.neon.tech equals the issuer the PRM named Revision 2026-07-28	Supported Neon Authorization server metadata discoverable Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.neon.tech/.well-known/oauth-authorization-server — HTTP 200; issuer: https://mcp.neon.tech Revision 2026-07-28	Supported Neon Protected Resource Metadata served Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.neon.tech/.well-known/oauth-protected-resource/mcp — HTTP 200; resource: https://mcp.neon.tech/mcp Revision 2026-07-28	Supported Neon PRM lists an authorization server Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.neon.tech/.well-known/oauth-protected-resource/mcp — HTTP 200; authorization_servers: [https://mcp.neon.tech] Revision 2026-07-28	Unsupported Neon PRM lists scopes_supported Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.neon.tech/.well-known/oauth-protected-resource/mcp — HTTP 200; scopes_supported: absent Revision 2026-07-28	Supported Neon PRM reachable at a well-known URI Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.neon.tech/.well-known/oauth-protected-resource/mcp — HTTP 200; found at the path-aware location Revision 2026-07-28	Supported Neon resource_metadata in the 401 challenge Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.neon.tech/mcp — HTTP 401; WWW-Authenticate resource_metadata: https://mcp.neon.tech/.well-known/oauth-protected-resource/mcp Revision 2026-07-28	Unsupported Neon Client ID Metadata Documents supported Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.neon.tech/.well-known/oauth-authorization-server — HTTP 200; client_id_metadata_document_supported: absent Revision 2026-07-28	Supported Neon Dynamic Client Registration offered Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.neon.tech/.well-known/oauth-authorization-server — HTTP 200; registration_endpoint: https://mcp.neon.tech/api/register Revision 2026-07-28	Unknown Neon Documented pre-registration path Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unsupported Neon Issuer identifier in authorization responses Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.neon.tech/.well-known/oauth-authorization-server — HTTP 200; authorization_response_iss_parameter_supported: absent Revision 2026-07-28	Supported Neon PKCE with S256 advertised Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.neon.tech/.well-known/oauth-authorization-server — HTTP 200; code_challenge_methods_supported: [S256] Revision 2026-07-28	Unknown Neon 403 insufficient_scope for step-up Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unsupported Neon Scope in the WWW-Authenticate challenge Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.neon.tech/mcp — HTTP 401; WWW-Authenticate: Bearer error="invalid_token", error_description="No authorization provided", resource_metadata="https://mcp.neon.tech/.well-known/oauth-protected-resource/mcp", no scope parameter Revision 2026-07-28	Unknown Neon Refresh token rotation for public clients Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Neon Resource indicators honoured Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported Neon No offline_access in advertised scopes Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.neon.tech/.well-known/oauth-authorization-server — HTTP 200; the authorization server's scopes_supported has no offline_access: [read, write]; the server advertises no scopes of its own Revision 2026-07-28	Unknown Neon 401 for missing or invalid tokens Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Neon Audience validation Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Neon Bearer token only in the Authorization header Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported Neon All endpoints served over HTTPS Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.neon.tech/.well-known/oauth-authorization-server — HTTP 200; all 4 endpoints use https Revision 2026-07-28	Unknown Neon No token passthrough to upstream APIs Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported Neon Per-client consent on proxy servers Supported Method vendor-claim Observed 2026-10-14 by jbspeakr (documentation pass with Claude Code) Evidence https://github.com/neondatabase/mcp-server-neon — "Connect with `https://mcp.neon.tech/mcp` and uncheck Allow writes on the authorization page." (README describes the remote server's own authorization page with editable consent ('For OAuth registration, `x-read-only` is an initial Allow-writes default on editable consent.') and a static upstream client (`CLIENT_ID`, `CLIENT_SECRET`, `UPSTREAM_OAUTH_HOST` env vars).) Revision 2026-07-28
Netlify CAccess: publicAuth: unknown	Supported Netlify Metadata issuer matches the discovery URL Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://netlify-mcp.netlify.app/.well-known/oauth-authorization-server — HTTP 200; issuer: https://netlify-mcp.netlify.app/ equals the issuer the PRM named Revision 2026-07-28	Supported Netlify Authorization server metadata discoverable Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://netlify-mcp.netlify.app/.well-known/oauth-authorization-server — HTTP 200; issuer: https://netlify-mcp.netlify.app/ Revision 2026-07-28	Supported Netlify Protected Resource Metadata served Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://netlify-mcp.netlify.app/.well-known/oauth-protected-resource/mcp — HTTP 200; resource: https://netlify-mcp.netlify.app/mcp Revision 2026-07-28	Supported Netlify PRM lists an authorization server Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://netlify-mcp.netlify.app/.well-known/oauth-protected-resource/mcp — HTTP 200; authorization_servers: [https://netlify-mcp.netlify.app/] Revision 2026-07-28	Supported Netlify PRM lists scopes_supported Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://netlify-mcp.netlify.app/.well-known/oauth-protected-resource/mcp — HTTP 200; scopes_supported: [offline_access, read, write, claudeai] Revision 2026-07-28	Supported Netlify PRM reachable at a well-known URI Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://netlify-mcp.netlify.app/.well-known/oauth-protected-resource/mcp — HTTP 200; found at the path-aware location Revision 2026-07-28	Supported Netlify resource_metadata in the 401 challenge Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://netlify-mcp.netlify.app/mcp — HTTP 401; WWW-Authenticate resource_metadata: https://netlify-mcp.netlify.app/.well-known/oauth-protected-resource/mcp Revision 2026-07-28	Unsupported Netlify Client ID Metadata Documents supported Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://netlify-mcp.netlify.app/.well-known/oauth-authorization-server — HTTP 200; client_id_metadata_document_supported: absent Revision 2026-07-28	Supported Netlify Dynamic Client Registration offered Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://netlify-mcp.netlify.app/.well-known/oauth-authorization-server — HTTP 200; registration_endpoint: https://netlify-mcp.netlify.app/oauth-server/reg Revision 2026-07-28	Unknown Netlify Documented pre-registration path Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unsupported Netlify Issuer identifier in authorization responses Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://netlify-mcp.netlify.app/.well-known/oauth-authorization-server — HTTP 200; authorization_response_iss_parameter_supported: absent Revision 2026-07-28	Supported Netlify PKCE with S256 advertised Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://netlify-mcp.netlify.app/.well-known/oauth-authorization-server — HTTP 200; code_challenge_methods_supported: [S256] Revision 2026-07-28	Unknown Netlify 403 insufficient_scope for step-up Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unsupported Netlify Scope in the WWW-Authenticate challenge Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://netlify-mcp.netlify.app/mcp — HTTP 401; WWW-Authenticate: Bearer realm="MCP Server", resource_metadata="https://netlify-mcp.netlify.app/.well-known/oauth-protected-resource/mcp", no scope parameter Revision 2026-07-28	Unknown Netlify Refresh token rotation for public clients Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Netlify Resource indicators honoured Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unsupported Netlify No offline_access in advertised scopes Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://netlify-mcp.netlify.app/.well-known/oauth-protected-resource/mcp — HTTP 200; scopes_supported includes offline_access: [offline_access, read, write, claudeai] Revision 2026-07-28	Unknown Netlify 401 for missing or invalid tokens Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Netlify Audience validation Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Netlify Bearer token only in the Authorization header Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported Netlify All endpoints served over HTTPS Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://netlify-mcp.netlify.app/.well-known/oauth-authorization-server — HTTP 200; all 3 endpoints use https Revision 2026-07-28	Unknown Netlify No token passthrough to upstream APIs Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Netlify Per-client consent on proxy servers Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.
Notion AAccess: publicAuth: oauth	Supported Notion Metadata issuer matches the discovery URL Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.notion.com/.well-known/oauth-authorization-server — HTTP 200; issuer: https://mcp.notion.com equals the issuer the PRM named Revision 2026-07-28	Supported Notion Authorization server metadata discoverable Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.notion.com/.well-known/oauth-authorization-server — HTTP 200; issuer: https://mcp.notion.com Revision 2026-07-28	Supported Notion Protected Resource Metadata served Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.notion.com/.well-known/oauth-protected-resource/sse — HTTP 200; resource: https://mcp.notion.com/sse Revision 2026-07-28	Supported Notion PRM lists an authorization server Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.notion.com/.well-known/oauth-protected-resource/sse — HTTP 200; authorization_servers: [https://mcp.notion.com] Revision 2026-07-28	Supported Notion PRM lists scopes_supported Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.notion.com/.well-known/oauth-protected-resource/sse — HTTP 200; scopes_supported: [default] Revision 2026-07-28	Supported Notion PRM reachable at a well-known URI Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.notion.com/.well-known/oauth-protected-resource/sse — HTTP 200; found at the path-aware location Revision 2026-07-28	Supported Notion resource_metadata in the 401 challenge Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.notion.com/sse — HTTP 401; WWW-Authenticate resource_metadata: https://mcp.notion.com/.well-known/oauth-protected-resource/sse Revision 2026-07-28	Supported Notion Client ID Metadata Documents supported Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.notion.com/.well-known/oauth-authorization-server — HTTP 200; client_id_metadata_document_supported: true Revision 2026-07-28	Supported Notion Dynamic Client Registration offered Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.notion.com/.well-known/oauth-authorization-server — HTTP 200; registration_endpoint: https://mcp.notion.com/register Revision 2026-07-28	Unknown Notion Documented pre-registration path Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported Notion Issuer identifier in authorization responses Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.notion.com/.well-known/oauth-authorization-server — HTTP 200; authorization_response_iss_parameter_supported: true Revision 2026-07-28	Supported Notion PKCE with S256 advertised Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.notion.com/.well-known/oauth-authorization-server — HTTP 200; code_challenge_methods_supported: [S256] Revision 2026-07-28	Unknown Notion 403 insufficient_scope for step-up Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported Notion Scope in the WWW-Authenticate challenge Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.notion.com/sse — HTTP 401; WWW-Authenticate scope: [default] Revision 2026-07-28	Supported Notion Refresh token rotation for public clients Supported Method vendor-claim Observed 2026-10-14 by jbspeakr (documentation pass with Claude Code) Evidence https://developers.notion.com/guides/mcp/build-mcp-client — "Every refresh rotates the refresh token: the token response returns a new `refresh_token`, and the one you sent is retired." ('A grant keeps at most two refresh tokens valid at once'; reusing a rotated-away refresh token can revoke the entire connection; absolute lifetime 180 days, 30 days inactivity.) Revision 2026-07-28	Unknown Notion Resource indicators honoured Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported Notion No offline_access in advertised scopes Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.notion.com/.well-known/oauth-protected-resource/sse — HTTP 200; scopes_supported without offline_access: [default] Revision 2026-07-28	Unknown Notion 401 for missing or invalid tokens Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Notion Audience validation Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Notion Bearer token only in the Authorization header Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported Notion All endpoints served over HTTPS Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.notion.com/.well-known/oauth-authorization-server — HTTP 200; all 5 endpoints use https Revision 2026-07-28	Unknown Notion No token passthrough to upstream APIs Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Notion Per-client consent on proxy servers Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.
PayPal CAccess: publicAuth: oauth	Supported PayPal Metadata issuer matches the discovery URL Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.paypal.com/.well-known/oauth-authorization-server — HTTP 200; issuer: https://mcp.paypal.com equals the issuer the PRM named Revision 2026-07-28	Supported PayPal Authorization server metadata discoverable Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.paypal.com/.well-known/oauth-authorization-server — HTTP 200; issuer: https://mcp.paypal.com Revision 2026-07-28	Supported PayPal Protected Resource Metadata served Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.paypal.com/.well-known/oauth-protected-resource/sse — HTTP 200; resource: https://mcp.paypal.com/sse Revision 2026-07-28	Supported PayPal PRM lists an authorization server Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.paypal.com/.well-known/oauth-protected-resource/sse — HTTP 200; authorization_servers: [https://mcp.paypal.com] Revision 2026-07-28	Unsupported PayPal PRM lists scopes_supported Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.paypal.com/.well-known/oauth-protected-resource/sse — HTTP 200; scopes_supported: absent Revision 2026-07-28	Supported PayPal PRM reachable at a well-known URI Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.paypal.com/.well-known/oauth-protected-resource/sse — HTTP 200; found at the path-aware location Revision 2026-07-28	Supported PayPal resource_metadata in the 401 challenge Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.paypal.com/sse — HTTP 401; WWW-Authenticate resource_metadata: https://mcp.paypal.com/.well-known/oauth-protected-resource/sse Revision 2026-07-28	Unsupported PayPal Client ID Metadata Documents supported Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.paypal.com/.well-known/oauth-authorization-server — HTTP 200; client_id_metadata_document_supported: false Revision 2026-07-28	Supported PayPal Dynamic Client Registration offered Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.paypal.com/.well-known/oauth-authorization-server — HTTP 200; registration_endpoint: https://mcp.paypal.com/register Revision 2026-07-28	Unknown PayPal Documented pre-registration path Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unsupported PayPal Issuer identifier in authorization responses Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.paypal.com/.well-known/oauth-authorization-server — HTTP 200; authorization_response_iss_parameter_supported: absent Revision 2026-07-28	Supported PayPal PKCE with S256 advertised Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.paypal.com/.well-known/oauth-authorization-server — HTTP 200; code_challenge_methods_supported: [S256] Revision 2026-07-28	Unknown PayPal 403 insufficient_scope for step-up Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unsupported PayPal Scope in the WWW-Authenticate challenge Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.paypal.com/sse — HTTP 401; WWW-Authenticate: Bearer realm="OAuth", resource_metadata="https://mcp.paypal.com/.well-known/oauth-protected-resource/sse", error="invalid_token", error_description="Missing or invalid access token", no scope parameter Revision 2026-07-28	Unknown PayPal Refresh token rotation for public clients Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown PayPal Resource indicators honoured Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown PayPal No offline_access in advertised scopes Unknown Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.paypal.com/.well-known/oauth-protected-resource/sse — HTTP 200; scopes_supported: absent, so no scope is advertised to judge Revision 2026-07-28	Unknown PayPal 401 for missing or invalid tokens Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown PayPal Audience validation Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown PayPal Bearer token only in the Authorization header Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported PayPal All endpoints served over HTTPS Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.paypal.com/.well-known/oauth-authorization-server — HTTP 200; all 4 endpoints use https Revision 2026-07-28	Unknown PayPal No token passthrough to upstream APIs Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown PayPal Per-client consent on proxy servers Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.
Plaid FAccess: closedAuth: oauth	Unknown Plaid Metadata issuer matches the discovery URL Unknown Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://api.dashboard.plaid.com/.well-known/oauth-protected-resource — HTTP 404; no protected resource metadata at a well-known location (HTTP 404, HTTP 404) and none reached through the challenge (challenge without resource_metadata) Revision 2026-07-28	Unknown Plaid Authorization server metadata discoverable Unknown Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://api.dashboard.plaid.com/.well-known/oauth-protected-resource — HTTP 404; no protected resource metadata at a well-known location (HTTP 404, HTTP 404) and none reached through the challenge (challenge without resource_metadata) Revision 2026-07-28	Unknown Plaid Protected Resource Metadata served Unknown Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://api.dashboard.plaid.com/.well-known/oauth-protected-resource — HTTP 404; no protected resource metadata at a well-known location (HTTP 404, HTTP 404) and none reached through the challenge (challenge without resource_metadata) Revision 2026-07-28	Unknown Plaid PRM lists an authorization server Unknown Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://api.dashboard.plaid.com/.well-known/oauth-protected-resource — HTTP 404; no protected resource metadata at a well-known location (HTTP 404, HTTP 404) and none reached through the challenge (challenge without resource_metadata) Revision 2026-07-28	Unknown Plaid PRM lists scopes_supported Unknown Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://api.dashboard.plaid.com/.well-known/oauth-protected-resource — HTTP 404; no protected resource metadata at a well-known location (HTTP 404, HTTP 404) and none reached through the challenge (challenge without resource_metadata) Revision 2026-07-28	Unsupported Plaid PRM reachable at a well-known URI Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://api.dashboard.plaid.com/.well-known/oauth-protected-resource — HTTP 404; not at either well-known location (path-aware HTTP 404, root HTTP 404) Revision 2026-07-28	Unsupported Plaid resource_metadata in the 401 challenge Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://api.dashboard.plaid.com/mcp/ — HTTP 401; WWW-Authenticate: absent, no resource_metadata parameter Revision 2026-07-28	Unknown Plaid Client ID Metadata Documents supported Unknown Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://api.dashboard.plaid.com/.well-known/oauth-protected-resource — HTTP 404; no protected resource metadata at a well-known location (HTTP 404, HTTP 404) and none reached through the challenge (challenge without resource_metadata) Revision 2026-07-28	Unknown Plaid Dynamic Client Registration offered Unknown Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://api.dashboard.plaid.com/.well-known/oauth-protected-resource — HTTP 404; no protected resource metadata at a well-known location (HTTP 404, HTTP 404) and none reached through the challenge (challenge without resource_metadata) Revision 2026-07-28	Unknown Plaid Documented pre-registration path Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Plaid Issuer identifier in authorization responses Unknown Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://api.dashboard.plaid.com/.well-known/oauth-protected-resource — HTTP 404; no protected resource metadata at a well-known location (HTTP 404, HTTP 404) and none reached through the challenge (challenge without resource_metadata) Revision 2026-07-28	Unknown Plaid PKCE with S256 advertised Unknown Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://api.dashboard.plaid.com/.well-known/oauth-protected-resource — HTTP 404; no protected resource metadata at a well-known location (HTTP 404, HTTP 404) and none reached through the challenge (challenge without resource_metadata) Revision 2026-07-28	Unknown Plaid 403 insufficient_scope for step-up Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unsupported Plaid Scope in the WWW-Authenticate challenge Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://api.dashboard.plaid.com/mcp/ — HTTP 401; WWW-Authenticate: absent, no scope parameter Revision 2026-07-28	Unknown Plaid Refresh token rotation for public clients Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Plaid Resource indicators honoured Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Plaid No offline_access in advertised scopes Unknown Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://api.dashboard.plaid.com/.well-known/oauth-protected-resource — HTTP 404; no protected resource metadata at a well-known location (HTTP 404, HTTP 404) and none reached through the challenge (challenge without resource_metadata) Revision 2026-07-28	Partial Plaid 401 for missing or invalid tokens Partial Method vendor-claim Observed 2026-10-14 by jbspeakr (documentation pass with Claude Code) Evidence https://plaid.com/docs/resources/mcp/ — "Access tokens for the MCP server expire after 15 minutes." (Docs say expired tokens make MCP requests 'fail with a `401` status code or a provider-specific authentication error'; the 401 is stated for direct calls, missing/invalid tokens are not addressed.) Revision 2026-07-28	Unknown Plaid Audience validation Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Plaid Bearer token only in the Authorization header Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Plaid All endpoints served over HTTPS Unknown Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://api.dashboard.plaid.com/.well-known/oauth-protected-resource — HTTP 404; no protected resource metadata at a well-known location (HTTP 404, HTTP 404) and none reached through the challenge (challenge without resource_metadata) Revision 2026-07-28	Unknown Plaid No token passthrough to upstream APIs Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Plaid Per-client consent on proxy servers Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.
Prisma Postgres CAccess: publicAuth: oauth	Supported Prisma Postgres Metadata issuer matches the discovery URL Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://auth.prisma.io/.well-known/oauth-authorization-server — HTTP 200; issuer: https://auth.prisma.io equals the issuer the PRM named Revision 2026-07-28	Supported Prisma Postgres Authorization server metadata discoverable Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://auth.prisma.io/.well-known/oauth-authorization-server — HTTP 200; issuer: https://auth.prisma.io Revision 2026-07-28	Supported Prisma Postgres Protected Resource Metadata served Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.prisma.io/.well-known/oauth-protected-resource/mcp — HTTP 200; resource: https://mcp.prisma.io/mcp Revision 2026-07-28	Supported Prisma Postgres PRM lists an authorization server Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.prisma.io/.well-known/oauth-protected-resource/mcp — HTTP 200; authorization_servers: [https://auth.prisma.io] Revision 2026-07-28	Supported Prisma Postgres PRM lists scopes_supported Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.prisma.io/.well-known/oauth-protected-resource/mcp — HTTP 200; scopes_supported: [workspace:admin, offline_access] Revision 2026-07-28	Supported Prisma Postgres PRM reachable at a well-known URI Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.prisma.io/.well-known/oauth-protected-resource/mcp — HTTP 200; found at the path-aware location Revision 2026-07-28	Supported Prisma Postgres resource_metadata in the 401 challenge Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.prisma.io/mcp — HTTP 401; WWW-Authenticate resource_metadata: https://mcp.prisma.io/.well-known/oauth-protected-resource/mcp Revision 2026-07-28	Unsupported Prisma Postgres Client ID Metadata Documents supported Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://auth.prisma.io/.well-known/oauth-authorization-server — HTTP 200; client_id_metadata_document_supported: absent Revision 2026-07-28	Supported Prisma Postgres Dynamic Client Registration offered Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://auth.prisma.io/.well-known/oauth-authorization-server — HTTP 200; registration_endpoint: https://auth.prisma.io/register Revision 2026-07-28	Unknown Prisma Postgres Documented pre-registration path Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unsupported Prisma Postgres Issuer identifier in authorization responses Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://auth.prisma.io/.well-known/oauth-authorization-server — HTTP 200; authorization_response_iss_parameter_supported: absent Revision 2026-07-28	Supported Prisma Postgres PKCE with S256 advertised Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://auth.prisma.io/.well-known/oauth-authorization-server — HTTP 200; code_challenge_methods_supported: [S256] Revision 2026-07-28	Unknown Prisma Postgres 403 insufficient_scope for step-up Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unsupported Prisma Postgres Scope in the WWW-Authenticate challenge Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.prisma.io/mcp — HTTP 401; WWW-Authenticate: Bearer error="invalid_token", error_description="Missing Authorization header", resource_metadata="https://mcp.prisma.io/.well-known/oauth-protected-resource/mcp", no scope parameter Revision 2026-07-28	Unknown Prisma Postgres Refresh token rotation for public clients Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Prisma Postgres Resource indicators honoured Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unsupported Prisma Postgres No offline_access in advertised scopes Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.prisma.io/.well-known/oauth-protected-resource/mcp — HTTP 200; scopes_supported includes offline_access: [workspace:admin, offline_access] Revision 2026-07-28	Unknown Prisma Postgres 401 for missing or invalid tokens Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Prisma Postgres Audience validation Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Prisma Postgres Bearer token only in the Authorization header Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported Prisma Postgres All endpoints served over HTTPS Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://auth.prisma.io/.well-known/oauth-authorization-server — HTTP 200; all 4 endpoints use https Revision 2026-07-28	Unknown Prisma Postgres No token passthrough to upstream APIs Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Prisma Postgres Per-client consent on proxy servers Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.
Ramp CAccess: unknownAuth: oauth	Supported Ramp Metadata issuer matches the discovery URL Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://ramp-mcp-remote.ramp.com/.well-known/oauth-authorization-server — HTTP 200; issuer: https://ramp-mcp-remote.ramp.com equals the issuer the PRM named Revision 2026-07-28	Supported Ramp Authorization server metadata discoverable Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://ramp-mcp-remote.ramp.com/.well-known/oauth-authorization-server — HTTP 200; issuer: https://ramp-mcp-remote.ramp.com Revision 2026-07-28	Supported Ramp Protected Resource Metadata served Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://ramp-mcp-remote.ramp.com/.well-known/oauth-protected-resource/mcp — HTTP 200; resource: https://ramp-mcp-remote.ramp.com/mcp Revision 2026-07-28	Supported Ramp PRM lists an authorization server Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://ramp-mcp-remote.ramp.com/.well-known/oauth-protected-resource/mcp — HTTP 200; authorization_servers: [https://ramp-mcp-remote.ramp.com] Revision 2026-07-28	Supported Ramp PRM lists scopes_supported Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://ramp-mcp-remote.ramp.com/.well-known/oauth-protected-resource/mcp — HTTP 200; scopes_supported: [bills:read, cards:read, departments:read, entities:read, limits:read, locations:read, memos:read, purchase_orders:read, reimbursements:read, spend_programs:read, transactions:read, users:read, v… Revision 2026-07-28	Supported Ramp PRM reachable at a well-known URI Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://ramp-mcp-remote.ramp.com/.well-known/oauth-protected-resource/mcp — HTTP 200; found at the path-aware location Revision 2026-07-28	Supported Ramp resource_metadata in the 401 challenge Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://ramp-mcp-remote.ramp.com/mcp — HTTP 401; WWW-Authenticate resource_metadata: https://ramp-mcp-remote.ramp.com/.well-known/oauth-protected-resource/mcp Revision 2026-07-28	Unsupported Ramp Client ID Metadata Documents supported Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://ramp-mcp-remote.ramp.com/.well-known/oauth-authorization-server — HTTP 200; client_id_metadata_document_supported: absent Revision 2026-07-28	Supported Ramp Dynamic Client Registration offered Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://ramp-mcp-remote.ramp.com/.well-known/oauth-authorization-server — HTTP 200; registration_endpoint: https://ramp-mcp-remote.ramp.com/register Revision 2026-07-28	Unknown Ramp Documented pre-registration path Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unsupported Ramp Issuer identifier in authorization responses Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://ramp-mcp-remote.ramp.com/.well-known/oauth-authorization-server — HTTP 200; authorization_response_iss_parameter_supported: absent Revision 2026-07-28	Supported Ramp PKCE with S256 advertised Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://ramp-mcp-remote.ramp.com/.well-known/oauth-authorization-server — HTTP 200; code_challenge_methods_supported: [S256] Revision 2026-07-28	Unknown Ramp 403 insufficient_scope for step-up Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unsupported Ramp Scope in the WWW-Authenticate challenge Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://ramp-mcp-remote.ramp.com/mcp — HTTP 401; WWW-Authenticate: Bearer resource_metadata="https://ramp-mcp-remote.ramp.com/.well-known/oauth-protected-resource/mcp", no scope parameter Revision 2026-07-28	Unknown Ramp Refresh token rotation for public clients Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Ramp Resource indicators honoured Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported Ramp No offline_access in advertised scopes Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://ramp-mcp-remote.ramp.com/.well-known/oauth-protected-resource/mcp — HTTP 200; scopes_supported without offline_access: [bills:read, cards:read, departments:read, entities:read, limits:read, locations:read, memos:read, purchase_orders:read, reimbursements:read, spend_programs:read, transacti… Revision 2026-07-28	Unknown Ramp 401 for missing or invalid tokens Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Ramp Audience validation Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Ramp Bearer token only in the Authorization header Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported Ramp All endpoints served over HTTPS Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://ramp-mcp-remote.ramp.com/.well-known/oauth-authorization-server — HTTP 200; all 4 endpoints use https Revision 2026-07-28	Unknown Ramp No token passthrough to upstream APIs Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Ramp Per-client consent on proxy servers Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.
Sentry CAccess: publicAuth: oauth	Supported Sentry Metadata issuer matches the discovery URL Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.sentry.dev/.well-known/oauth-authorization-server — HTTP 200; issuer: https://mcp.sentry.dev equals the issuer the PRM named Revision 2026-07-28	Supported Sentry Authorization server metadata discoverable Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.sentry.dev/.well-known/oauth-authorization-server — HTTP 200; issuer: https://mcp.sentry.dev Revision 2026-07-28	Supported Sentry Protected Resource Metadata served Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.sentry.dev/.well-known/oauth-protected-resource/mcp — HTTP 200; resource: https://mcp.sentry.dev/mcp Revision 2026-07-28	Supported Sentry PRM lists an authorization server Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.sentry.dev/.well-known/oauth-protected-resource/mcp — HTTP 200; authorization_servers: [https://mcp.sentry.dev] Revision 2026-07-28	Supported Sentry PRM lists scopes_supported Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.sentry.dev/.well-known/oauth-protected-resource/mcp — HTTP 200; scopes_supported: [org:read, project:write, team:write, event:write, alerts:write] Revision 2026-07-28	Supported Sentry PRM reachable at a well-known URI Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.sentry.dev/.well-known/oauth-protected-resource/mcp — HTTP 200; found at the path-aware location Revision 2026-07-28	Supported Sentry resource_metadata in the 401 challenge Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.sentry.dev/mcp — HTTP 401; WWW-Authenticate resource_metadata: https://mcp.sentry.dev/.well-known/oauth-protected-resource/mcp Revision 2026-07-28	Supported Sentry Client ID Metadata Documents supported Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.sentry.dev/.well-known/oauth-authorization-server — HTTP 200; client_id_metadata_document_supported: true Revision 2026-07-28	Supported Sentry Dynamic Client Registration offered Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.sentry.dev/.well-known/oauth-authorization-server — HTTP 200; registration_endpoint: https://mcp.sentry.dev/oauth/register Revision 2026-07-28	Unknown Sentry Documented pre-registration path Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported Sentry Issuer identifier in authorization responses Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.sentry.dev/.well-known/oauth-authorization-server — HTTP 200; authorization_response_iss_parameter_supported: true Revision 2026-07-28	Supported Sentry PKCE with S256 advertised Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.sentry.dev/.well-known/oauth-authorization-server — HTTP 200; code_challenge_methods_supported: [S256] Revision 2026-07-28	Unknown Sentry 403 insufficient_scope for step-up Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unsupported Sentry Scope in the WWW-Authenticate challenge Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.sentry.dev/mcp — HTTP 401; WWW-Authenticate: Bearer realm="OAuth", resource_metadata="https://mcp.sentry.dev/.well-known/oauth-protected-resource/mcp", no scope parameter Revision 2026-07-28	Unknown Sentry Refresh token rotation for public clients Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Sentry Resource indicators honoured Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported Sentry No offline_access in advertised scopes Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.sentry.dev/.well-known/oauth-protected-resource/mcp — HTTP 200; scopes_supported without offline_access: [org:read, project:write, team:write, event:write, alerts:write] Revision 2026-07-28	Unknown Sentry 401 for missing or invalid tokens Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Sentry Audience validation Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Sentry Bearer token only in the Authorization header Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported Sentry All endpoints served over HTTPS Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.sentry.dev/.well-known/oauth-authorization-server — HTTP 200; all 4 endpoints use https Revision 2026-07-28	Partial Sentry No token passthrough to upstream APIs Partial Method vendor-claim Observed 2026-10-14 by jbspeakr (documentation pass with Claude Code) Evidence https://github.com/getsentry/sentry-mcp/blob/main/README.md — "With `Sentry-Bearer`, the worker does not store, validate, exchange, or refresh the upstream token. It forwards the token through the same Sentry API calls used by OAuth-backed sessions." (Passthrough happens only in the optional Sentry-Bearer mode, where the client supplies an upstream Sentry API token itself; the README states 'Bearer is reserved for MCP OAuth access tokens'. Behaviour of OAuth-backed sessions is not described.) Revision 2026-07-28	Unknown Sentry Per-client consent on proxy servers Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.
Slack CAccess: closedAuth: oauth	Supported Slack Metadata issuer matches the discovery URL Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.slack.com/.well-known/oauth-authorization-server — HTTP 200; issuer: https://mcp.slack.com equals the issuer the PRM named Revision 2026-07-28	Supported Slack Authorization server metadata discoverable Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.slack.com/.well-known/oauth-authorization-server — HTTP 200; issuer: https://mcp.slack.com Revision 2026-07-28	Supported Slack Protected Resource Metadata served Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.slack.com/.well-known/oauth-protected-resource — HTTP 200; resource: https://mcp.slack.com Revision 2026-07-28	Supported Slack PRM lists an authorization server Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.slack.com/.well-known/oauth-protected-resource — HTTP 200; authorization_servers: [https://mcp.slack.com] Revision 2026-07-28	Supported Slack PRM lists scopes_supported Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.slack.com/.well-known/oauth-protected-resource — HTTP 200; scopes_supported: [canvases:read, canvases:write, channels:history, channels:read, channels:write, chat:write, emoji:read, files:read, files:write, groups:history, groups:read, groups:write, im:history, im:read, im:write, lists:… Revision 2026-07-28	Supported Slack PRM reachable at a well-known URI Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.slack.com/.well-known/oauth-protected-resource — HTTP 200; found at the root location Revision 2026-07-28	Supported Slack resource_metadata in the 401 challenge Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.slack.com/mcp — HTTP 401; WWW-Authenticate resource_metadata: https://mcp.slack.com/.well-known/oauth-protected-resource Revision 2026-07-28	Unsupported Slack Client ID Metadata Documents supported Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.slack.com/.well-known/oauth-authorization-server — HTTP 200; client_id_metadata_document_supported: absent Revision 2026-07-28	Unsupported Slack Dynamic Client Registration offered Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.slack.com/.well-known/oauth-authorization-server — HTTP 200; registration_endpoint: absent Revision 2026-07-28	Supported Slack Documented pre-registration path Supported Method vendor-claim Observed 2026-10-14 by jbspeakr (documentation pass with Claude Code) Evidence https://docs.slack.dev/ai/slack-mcp-server/ — "MCP clients must be backed by a registered Slack app with a fixed app ID and hardcode that app ID. Slack supports confidential OAuth for MCP clients. You'll need to use your app's `client_id` and `client_secret` for Slack OAuth." (Only directory-published (Slack Marketplace) or internal apps may use MCP; unlisted apps are prohibited.) Revision 2026-07-28	Unsupported Slack Issuer identifier in authorization responses Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.slack.com/.well-known/oauth-authorization-server — HTTP 200; authorization_response_iss_parameter_supported: absent Revision 2026-07-28	Supported Slack PKCE with S256 advertised Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.slack.com/.well-known/oauth-authorization-server — HTTP 200; code_challenge_methods_supported: [S256] Revision 2026-07-28	Unknown Slack 403 insufficient_scope for step-up Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unsupported Slack Scope in the WWW-Authenticate challenge Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.slack.com/mcp — HTTP 401; WWW-Authenticate: Bearer resource_metadata="https://mcp.slack.com/.well-known/oauth-protected-resource", no scope parameter Revision 2026-07-28	Unknown Slack Refresh token rotation for public clients Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Slack Resource indicators honoured Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported Slack No offline_access in advertised scopes Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.slack.com/.well-known/oauth-protected-resource — HTTP 200; scopes_supported without offline_access: [canvases:read, canvases:write, channels:history, channels:read, channels:write, chat:write, emoji:read, files:read, files:write, groups:history, groups:read, groups:write, im:history, im… Revision 2026-07-28	Unknown Slack 401 for missing or invalid tokens Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Slack Audience validation Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Slack Bearer token only in the Authorization header Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported Slack All endpoints served over HTTPS Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.slack.com/.well-known/oauth-authorization-server — HTTP 200; all 2 endpoints use https Revision 2026-07-28	Unknown Slack No token passthrough to upstream APIs Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Slack Per-client consent on proxy servers Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.
Square CAccess: publicAuth: oauth	Supported Square Metadata issuer matches the discovery URL Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.squareup.com/.well-known/oauth-authorization-server — HTTP 200; issuer: https://mcp.squareup.com equals the issuer the PRM named Revision 2026-07-28	Supported Square Authorization server metadata discoverable Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.squareup.com/.well-known/oauth-authorization-server — HTTP 200; issuer: https://mcp.squareup.com Revision 2026-07-28	Supported Square Protected Resource Metadata served Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.squareup.com/.well-known/oauth-protected-resource/sse — HTTP 200; resource: https://mcp.squareup.com/sse Revision 2026-07-28	Supported Square PRM lists an authorization server Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.squareup.com/.well-known/oauth-protected-resource/sse — HTTP 200; authorization_servers: [https://mcp.squareup.com] Revision 2026-07-28	Unsupported Square PRM lists scopes_supported Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.squareup.com/.well-known/oauth-protected-resource/sse — HTTP 200; scopes_supported: absent Revision 2026-07-28	Supported Square PRM reachable at a well-known URI Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.squareup.com/.well-known/oauth-protected-resource/sse — HTTP 200; found at the path-aware location Revision 2026-07-28	Supported Square resource_metadata in the 401 challenge Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.squareup.com/sse — HTTP 401; WWW-Authenticate resource_metadata: https://mcp.squareup.com/.well-known/oauth-protected-resource/sse Revision 2026-07-28	Unsupported Square Client ID Metadata Documents supported Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.squareup.com/.well-known/oauth-authorization-server — HTTP 200; client_id_metadata_document_supported: false Revision 2026-07-28	Supported Square Dynamic Client Registration offered Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.squareup.com/.well-known/oauth-authorization-server — HTTP 200; registration_endpoint: https://mcp.squareup.com/register Revision 2026-07-28	Unknown Square Documented pre-registration path Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unsupported Square Issuer identifier in authorization responses Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.squareup.com/.well-known/oauth-authorization-server — HTTP 200; authorization_response_iss_parameter_supported: absent Revision 2026-07-28	Supported Square PKCE with S256 advertised Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.squareup.com/.well-known/oauth-authorization-server — HTTP 200; code_challenge_methods_supported: [plain, S256] Revision 2026-07-28	Unknown Square 403 insufficient_scope for step-up Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unsupported Square Scope in the WWW-Authenticate challenge Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.squareup.com/sse — HTTP 401; WWW-Authenticate: Bearer realm="OAuth", resource_metadata="https://mcp.squareup.com/.well-known/oauth-protected-resource/sse", error="invalid_token", error_description="Missing or invalid access token", no scope parameter Revision 2026-07-28	Unknown Square Refresh token rotation for public clients Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Square Resource indicators honoured Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Square No offline_access in advertised scopes Unknown Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.squareup.com/.well-known/oauth-protected-resource/sse — HTTP 200; scopes_supported: absent, so no scope is advertised to judge Revision 2026-07-28	Unknown Square 401 for missing or invalid tokens Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Square Audience validation Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Square Bearer token only in the Authorization header Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported Square All endpoints served over HTTPS Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.squareup.com/.well-known/oauth-authorization-server — HTTP 200; all 4 endpoints use https Revision 2026-07-28	Unknown Square No token passthrough to upstream APIs Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Square Per-client consent on proxy servers Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.
Stack Overflow FAccess: publicAuth: oauth	Unknown Stack Overflow Metadata issuer matches the discovery URL Unknown Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.stackoverflow.com/.well-known/oauth-protected-resource — HTTP 404; no protected resource metadata at a well-known location (HTTP 404) and none reached through the challenge (challenge without resource_metadata) Revision 2026-07-28	Unknown Stack Overflow Authorization server metadata discoverable Unknown Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.stackoverflow.com/.well-known/oauth-protected-resource — HTTP 404; no protected resource metadata at a well-known location (HTTP 404) and none reached through the challenge (challenge without resource_metadata) Revision 2026-07-28	Unknown Stack Overflow Protected Resource Metadata served Unknown Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.stackoverflow.com/.well-known/oauth-protected-resource — HTTP 404; no protected resource metadata at a well-known location (HTTP 404) and none reached through the challenge (challenge without resource_metadata) Revision 2026-07-28	Unknown Stack Overflow PRM lists an authorization server Unknown Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.stackoverflow.com/.well-known/oauth-protected-resource — HTTP 404; no protected resource metadata at a well-known location (HTTP 404) and none reached through the challenge (challenge without resource_metadata) Revision 2026-07-28	Unknown Stack Overflow PRM lists scopes_supported Unknown Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.stackoverflow.com/.well-known/oauth-protected-resource — HTTP 404; no protected resource metadata at a well-known location (HTTP 404) and none reached through the challenge (challenge without resource_metadata) Revision 2026-07-28	Unsupported Stack Overflow PRM reachable at a well-known URI Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.stackoverflow.com/.well-known/oauth-protected-resource — HTTP 404; not at either well-known location (root HTTP 404) Revision 2026-07-28	Unsupported Stack Overflow resource_metadata in the 401 challenge Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.stackoverflow.com/ — HTTP 401; WWW-Authenticate: Bearer, no resource_metadata parameter Revision 2026-07-28	Unknown Stack Overflow Client ID Metadata Documents supported Unknown Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.stackoverflow.com/.well-known/oauth-protected-resource — HTTP 404; no protected resource metadata at a well-known location (HTTP 404) and none reached through the challenge (challenge without resource_metadata) Revision 2026-07-28	Unknown Stack Overflow Dynamic Client Registration offered Unknown Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.stackoverflow.com/.well-known/oauth-protected-resource — HTTP 404; no protected resource metadata at a well-known location (HTTP 404) and none reached through the challenge (challenge without resource_metadata) Revision 2026-07-28	Unknown Stack Overflow Documented pre-registration path Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Stack Overflow Issuer identifier in authorization responses Unknown Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.stackoverflow.com/.well-known/oauth-protected-resource — HTTP 404; no protected resource metadata at a well-known location (HTTP 404) and none reached through the challenge (challenge without resource_metadata) Revision 2026-07-28	Unknown Stack Overflow PKCE with S256 advertised Unknown Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.stackoverflow.com/.well-known/oauth-protected-resource — HTTP 404; no protected resource metadata at a well-known location (HTTP 404) and none reached through the challenge (challenge without resource_metadata) Revision 2026-07-28	Unknown Stack Overflow 403 insufficient_scope for step-up Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unsupported Stack Overflow Scope in the WWW-Authenticate challenge Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.stackoverflow.com/ — HTTP 401; WWW-Authenticate: Bearer, no scope parameter Revision 2026-07-28	Unknown Stack Overflow Refresh token rotation for public clients Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Stack Overflow Resource indicators honoured Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Stack Overflow No offline_access in advertised scopes Unknown Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.stackoverflow.com/.well-known/oauth-protected-resource — HTTP 404; no protected resource metadata at a well-known location (HTTP 404) and none reached through the challenge (challenge without resource_metadata) Revision 2026-07-28	Unknown Stack Overflow 401 for missing or invalid tokens Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Stack Overflow Audience validation Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Stack Overflow Bearer token only in the Authorization header Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Stack Overflow All endpoints served over HTTPS Unknown Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.stackoverflow.com/.well-known/oauth-protected-resource — HTTP 404; no protected resource metadata at a well-known location (HTTP 404) and none reached through the challenge (challenge without resource_metadata) Revision 2026-07-28	Unknown Stack Overflow No token passthrough to upstream APIs Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Stack Overflow Per-client consent on proxy servers Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.
Stripe CAccess: publicAuth: oauth	Supported Stripe Metadata issuer matches the discovery URL Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://access.stripe.com/.well-known/oauth-authorization-server/mcp — HTTP 200; issuer: https://access.stripe.com/mcp equals the issuer the PRM named Revision 2026-07-28	Supported Stripe Authorization server metadata discoverable Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://access.stripe.com/.well-known/oauth-authorization-server/mcp — HTTP 200; issuer: https://access.stripe.com/mcp Revision 2026-07-28	Supported Stripe Protected Resource Metadata served Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.stripe.com/.well-known/oauth-protected-resource — HTTP 200; resource: https://mcp.stripe.com Revision 2026-07-28	Supported Stripe PRM lists an authorization server Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.stripe.com/.well-known/oauth-protected-resource — HTTP 200; authorization_servers: [https://access.stripe.com/mcp] Revision 2026-07-28	Supported Stripe PRM lists scopes_supported Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.stripe.com/.well-known/oauth-protected-resource — HTTP 200; scopes_supported: [mcp] Revision 2026-07-28	Supported Stripe PRM reachable at a well-known URI Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.stripe.com/.well-known/oauth-protected-resource — HTTP 200; found at the root location Revision 2026-07-28	Supported Stripe resource_metadata in the 401 challenge Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.stripe.com/ — HTTP 401; WWW-Authenticate resource_metadata: https://mcp.stripe.com/.well-known/oauth-protected-resource Revision 2026-07-28	Unsupported Stripe Client ID Metadata Documents supported Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://access.stripe.com/.well-known/oauth-authorization-server/mcp — HTTP 200; client_id_metadata_document_supported: absent Revision 2026-07-28	Supported Stripe Dynamic Client Registration offered Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://access.stripe.com/.well-known/oauth-authorization-server/mcp — HTTP 200; registration_endpoint: https://access.stripe.com/mcp/oauth2/register Revision 2026-07-28	Unknown Stripe Documented pre-registration path Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unsupported Stripe Issuer identifier in authorization responses Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://access.stripe.com/.well-known/oauth-authorization-server/mcp — HTTP 200; authorization_response_iss_parameter_supported: absent Revision 2026-07-28	Supported Stripe PKCE with S256 advertised Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://access.stripe.com/.well-known/oauth-authorization-server/mcp — HTTP 200; code_challenge_methods_supported: [S256] Revision 2026-07-28	Unknown Stripe 403 insufficient_scope for step-up Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unsupported Stripe Scope in the WWW-Authenticate challenge Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.stripe.com/ — HTTP 401; WWW-Authenticate: Bearer resource_metadata="https://mcp.stripe.com/.well-known/oauth-protected-resource", no scope parameter Revision 2026-07-28	Unknown Stripe Refresh token rotation for public clients Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Stripe Resource indicators honoured Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported Stripe No offline_access in advertised scopes Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.stripe.com/.well-known/oauth-protected-resource — HTTP 200; scopes_supported without offline_access: [mcp] Revision 2026-07-28	Unknown Stripe 401 for missing or invalid tokens Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Stripe Audience validation Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Stripe Bearer token only in the Authorization header Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported Stripe All endpoints served over HTTPS Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://access.stripe.com/.well-known/oauth-authorization-server/mcp — HTTP 200; all 4 endpoints use https Revision 2026-07-28	Unknown Stripe No token passthrough to upstream APIs Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Stripe Per-client consent on proxy servers Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.
Supabase CAccess: publicAuth: oauth	Supported Supabase Metadata issuer matches the discovery URL Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://api.supabase.com/.well-known/oauth-authorization-server — HTTP 200; issuer: https://api.supabase.com equals the issuer the PRM named Revision 2026-07-28	Supported Supabase Authorization server metadata discoverable Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://api.supabase.com/.well-known/oauth-authorization-server — HTTP 200; issuer: https://api.supabase.com Revision 2026-07-28	Supported Supabase Protected Resource Metadata served Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.supabase.com/.well-known/oauth-protected-resource/mcp — HTTP 200; resource: https://mcp.supabase.com/mcp Revision 2026-07-28	Supported Supabase PRM lists an authorization server Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.supabase.com/.well-known/oauth-protected-resource/mcp — HTTP 200; authorization_servers: [https://api.supabase.com] Revision 2026-07-28	Supported Supabase PRM lists scopes_supported Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.supabase.com/.well-known/oauth-protected-resource/mcp — HTTP 200; scopes_supported: [organizations:read, projects:read, projects:write, database:write, database:read, analytics:read, secrets:read, edge_functions:read, edge_functions:write, environment:read, environment:write, storage:re… Revision 2026-07-28	Supported Supabase PRM reachable at a well-known URI Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.supabase.com/.well-known/oauth-protected-resource/mcp — HTTP 200; found at the path-aware location Revision 2026-07-28	Supported Supabase resource_metadata in the 401 challenge Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.supabase.com/mcp — HTTP 401; WWW-Authenticate resource_metadata: https://mcp.supabase.com/.well-known/oauth-protected-resource/mcp Revision 2026-07-28	Unsupported Supabase Client ID Metadata Documents supported Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://api.supabase.com/.well-known/oauth-authorization-server — HTTP 200; client_id_metadata_document_supported: absent Revision 2026-07-28	Supported Supabase Dynamic Client Registration offered Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://api.supabase.com/.well-known/oauth-authorization-server — HTTP 200; registration_endpoint: https://api.supabase.com/platform/oauth/apps/register Revision 2026-07-28	Supported Supabase Documented pre-registration path Supported Method vendor-claim Observed 2026-10-14 by jbspeakr (documentation pass with Claude Code) Evidence https://supabase.com/docs/guides/ai-tools/mcp — "If your MCP client requires an OAuth client ID and secret (e.g. Azure API Center), you can manually create an OAuth app in your Supabase account. [...] After creating the OAuth app, copy the client ID and client secret to your MCP client." (Docs say to grant write access to all scopes: 'In the future, the MCP server will support more fine-grained scopes, but for now all scopes are required.') Revision 2026-07-28	Supported Supabase Issuer identifier in authorization responses Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://api.supabase.com/.well-known/oauth-authorization-server — HTTP 200; authorization_response_iss_parameter_supported: true Revision 2026-07-28	Supported Supabase PKCE with S256 advertised Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://api.supabase.com/.well-known/oauth-authorization-server — HTTP 200; code_challenge_methods_supported: [S256, plain] Revision 2026-07-28	Unknown Supabase 403 insufficient_scope for step-up Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unsupported Supabase Scope in the WWW-Authenticate challenge Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.supabase.com/mcp — HTTP 401; WWW-Authenticate: Bearer resource_metadata="https://mcp.supabase.com/.well-known/oauth-protected-resource/mcp", no scope parameter Revision 2026-07-28	Unknown Supabase Refresh token rotation for public clients Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Supabase Resource indicators honoured Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported Supabase No offline_access in advertised scopes Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.supabase.com/.well-known/oauth-protected-resource/mcp — HTTP 200; scopes_supported without offline_access: [organizations:read, projects:read, projects:write, database:write, database:read, analytics:read, secrets:read, edge_functions:read, edge_functions:write, environment:read, enviro… Revision 2026-07-28	Unknown Supabase 401 for missing or invalid tokens Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Supabase Audience validation Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Supabase Bearer token only in the Authorization header Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported Supabase All endpoints served over HTTPS Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://api.supabase.com/.well-known/oauth-authorization-server — HTTP 200; all 3 endpoints use https Revision 2026-07-28	Unknown Supabase No token passthrough to upstream APIs Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Supabase Per-client consent on proxy servers Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.
Todoist CAccess: publicAuth: oauth	Supported Todoist Metadata issuer matches the discovery URL Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://todoist.com/.well-known/oauth-authorization-server — HTTP 200; issuer: https://todoist.com equals the issuer the PRM named Revision 2026-07-28	Supported Todoist Authorization server metadata discoverable Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://todoist.com/.well-known/oauth-authorization-server — HTTP 200; issuer: https://todoist.com Revision 2026-07-28	Supported Todoist Protected Resource Metadata served Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://ai.todoist.net/.well-known/oauth-protected-resource/mcp — HTTP 200; resource: https://ai.todoist.net/mcp Revision 2026-07-28	Supported Todoist PRM lists an authorization server Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://ai.todoist.net/.well-known/oauth-protected-resource/mcp — HTTP 200; authorization_servers: [https://todoist.com] Revision 2026-07-28	Supported Todoist PRM lists scopes_supported Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://ai.todoist.net/.well-known/oauth-protected-resource/mcp — HTTP 200; scopes_supported: [data:read_write] Revision 2026-07-28	Supported Todoist PRM reachable at a well-known URI Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://ai.todoist.net/.well-known/oauth-protected-resource/mcp — HTTP 200; found at the path-aware location Revision 2026-07-28	Supported Todoist resource_metadata in the 401 challenge Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://ai.todoist.net/mcp — HTTP 401; WWW-Authenticate resource_metadata: https://ai.todoist.net/.well-known/oauth-protected-resource/mcp Revision 2026-07-28	Supported Todoist Client ID Metadata Documents supported Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://todoist.com/.well-known/oauth-authorization-server — HTTP 200; client_id_metadata_document_supported: true Revision 2026-07-28	Supported Todoist Dynamic Client Registration offered Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://todoist.com/.well-known/oauth-authorization-server — HTTP 200; registration_endpoint: https://todoist.com/oauth/register Revision 2026-07-28	Unknown Todoist Documented pre-registration path Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unsupported Todoist Issuer identifier in authorization responses Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://todoist.com/.well-known/oauth-authorization-server — HTTP 200; authorization_response_iss_parameter_supported: absent Revision 2026-07-28	Supported Todoist PKCE with S256 advertised Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://todoist.com/.well-known/oauth-authorization-server — HTTP 200; code_challenge_methods_supported: [S256] Revision 2026-07-28	Unknown Todoist 403 insufficient_scope for step-up Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unsupported Todoist Scope in the WWW-Authenticate challenge Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://ai.todoist.net/mcp — HTTP 401; WWW-Authenticate: Bearer resource_metadata="https://ai.todoist.net/.well-known/oauth-protected-resource/mcp", no scope parameter Revision 2026-07-28	Unknown Todoist Refresh token rotation for public clients Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Todoist Resource indicators honoured Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported Todoist No offline_access in advertised scopes Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://ai.todoist.net/.well-known/oauth-protected-resource/mcp — HTTP 200; scopes_supported without offline_access: [data:read_write] Revision 2026-07-28	Unknown Todoist 401 for missing or invalid tokens Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Todoist Audience validation Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Todoist Bearer token only in the Authorization header Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported Todoist All endpoints served over HTTPS Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://todoist.com/.well-known/oauth-authorization-server — HTTP 200; all 5 endpoints use https Revision 2026-07-28	Unknown Todoist No token passthrough to upstream APIs Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Todoist Per-client consent on proxy servers Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.
Vercel CAccess: publicAuth: oauth	Supported Vercel Metadata issuer matches the discovery URL Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://vercel.com/.well-known/oauth-authorization-server — HTTP 200; issuer: https://vercel.com equals the issuer the PRM named Revision 2026-07-28	Supported Vercel Authorization server metadata discoverable Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://vercel.com/.well-known/oauth-authorization-server — HTTP 200; issuer: https://vercel.com Revision 2026-07-28	Supported Vercel Protected Resource Metadata served Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.vercel.com/.well-known/oauth-protected-resource — HTTP 200; resource: https://mcp.vercel.com/ Revision 2026-07-28	Supported Vercel PRM lists an authorization server Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.vercel.com/.well-known/oauth-protected-resource — HTTP 200; authorization_servers: [https://vercel.com] Revision 2026-07-28	Supported Vercel PRM lists scopes_supported Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.vercel.com/.well-known/oauth-protected-resource — HTTP 200; scopes_supported: [openid] Revision 2026-07-28	Supported Vercel PRM reachable at a well-known URI Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.vercel.com/.well-known/oauth-protected-resource — HTTP 200; found at the root location Revision 2026-07-28	Supported Vercel resource_metadata in the 401 challenge Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.vercel.com/ — HTTP 401; WWW-Authenticate resource_metadata: https://mcp.vercel.com/.well-known/oauth-protected-resource Revision 2026-07-28	Unsupported Vercel Client ID Metadata Documents supported Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://vercel.com/.well-known/oauth-authorization-server — HTTP 200; client_id_metadata_document_supported: absent Revision 2026-07-28	Supported Vercel Dynamic Client Registration offered Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://vercel.com/.well-known/oauth-authorization-server — HTTP 200; registration_endpoint: https://api.vercel.com/login/oauth/register Revision 2026-07-28	Partial Vercel Documented pre-registration path Partial Method vendor-claim Observed 2026-10-14 by jbspeakr (documentation pass with Claude Code) Evidence https://vercel.com/docs/mcp/vercel-mcp — "To ensure secure access, Vercel MCP only supports AI clients that have been reviewed and approved by Vercel. If you're building an MCP client and want it included in the supported clients list below, submit the client review form." (The documented path is a manual allowlist review, not self-service issuance of client credentials; docs do not say whether approved clients receive credentials or are allowlisted by redirect URI.) Revision 2026-07-28	Unsupported Vercel Issuer identifier in authorization responses Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://vercel.com/.well-known/oauth-authorization-server — HTTP 200; authorization_response_iss_parameter_supported: absent Revision 2026-07-28	Supported Vercel PKCE with S256 advertised Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://vercel.com/.well-known/oauth-authorization-server — HTTP 200; code_challenge_methods_supported: [S256] Revision 2026-07-28	Unknown Vercel 403 insufficient_scope for step-up Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unsupported Vercel Scope in the WWW-Authenticate challenge Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.vercel.com/ — HTTP 401; WWW-Authenticate: Bearer error="invalid_token", error_description="No authorization provided", resource_metadata="https://mcp.vercel.com/.well-known/oauth-protected-resource", no scope parameter Revision 2026-07-28	Unknown Vercel Refresh token rotation for public clients Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Vercel Resource indicators honoured Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported Vercel No offline_access in advertised scopes Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.vercel.com/.well-known/oauth-protected-resource — HTTP 200; scopes_supported without offline_access: [openid] Revision 2026-07-28	Unknown Vercel 401 for missing or invalid tokens Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Vercel Audience validation Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Vercel Bearer token only in the Authorization header Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported Vercel All endpoints served over HTTPS Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://vercel.com/.well-known/oauth-authorization-server — HTTP 200; all 8 endpoints use https Revision 2026-07-28	Unknown Vercel No token passthrough to upstream APIs Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported Vercel Per-client consent on proxy servers Supported Method vendor-claim Observed 2026-10-14 by jbspeakr (documentation pass with Claude Code) Evidence https://vercel.com/docs/mcp/vercel-mcp — "Vercel MCP protects against confused deputy attacks by requiring explicit user consent for each client connection" (Vercel acts as its own authorization server rather than a proxy; recorded because the per-client consent behaviour is explicitly stated. The blog post also states: 'We maintain an allowlist of approved clients and require an OAuth consent screen on every connection.' (https://vercel.com/blog/introducing-vercel-mcp-connect-vercel-to-your-ai-tools)) Revision 2026-07-28
Webflow CAccess: publicAuth: oauth	Supported Webflow Metadata issuer matches the discovery URL Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.webflow.com/.well-known/oauth-authorization-server — HTTP 200; issuer: https://mcp.webflow.com equals the issuer the PRM named Revision 2026-07-28	Supported Webflow Authorization server metadata discoverable Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.webflow.com/.well-known/oauth-authorization-server — HTTP 200; issuer: https://mcp.webflow.com Revision 2026-07-28	Supported Webflow Protected Resource Metadata served Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.webflow.com/.well-known/oauth-protected-resource/sse — HTTP 200; resource: https://mcp.webflow.com/sse Revision 2026-07-28	Supported Webflow PRM lists an authorization server Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.webflow.com/.well-known/oauth-protected-resource/sse — HTTP 200; authorization_servers: [https://mcp.webflow.com] Revision 2026-07-28	Unsupported Webflow PRM lists scopes_supported Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.webflow.com/.well-known/oauth-protected-resource/sse — HTTP 200; scopes_supported: absent Revision 2026-07-28	Supported Webflow PRM reachable at a well-known URI Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.webflow.com/.well-known/oauth-protected-resource/sse — HTTP 200; found at the path-aware location Revision 2026-07-28	Supported Webflow resource_metadata in the 401 challenge Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.webflow.com/sse — HTTP 401; WWW-Authenticate resource_metadata: https://mcp.webflow.com/.well-known/oauth-protected-resource/sse Revision 2026-07-28	Unsupported Webflow Client ID Metadata Documents supported Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.webflow.com/.well-known/oauth-authorization-server — HTTP 200; client_id_metadata_document_supported: false Revision 2026-07-28	Supported Webflow Dynamic Client Registration offered Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.webflow.com/.well-known/oauth-authorization-server — HTTP 200; registration_endpoint: https://mcp.webflow.com/oauth/register Revision 2026-07-28	Unknown Webflow Documented pre-registration path Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unsupported Webflow Issuer identifier in authorization responses Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.webflow.com/.well-known/oauth-authorization-server — HTTP 200; authorization_response_iss_parameter_supported: absent Revision 2026-07-28	Supported Webflow PKCE with S256 advertised Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.webflow.com/.well-known/oauth-authorization-server — HTTP 200; code_challenge_methods_supported: [plain, S256] Revision 2026-07-28	Unknown Webflow 403 insufficient_scope for step-up Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unsupported Webflow Scope in the WWW-Authenticate challenge Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.webflow.com/sse — HTTP 401; WWW-Authenticate: Bearer realm="OAuth", resource_metadata="https://mcp.webflow.com/.well-known/oauth-protected-resource/sse", error="invalid_token", error_description="Missing or invalid access token", no scope parameter Revision 2026-07-28	Unknown Webflow Refresh token rotation for public clients Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Webflow Resource indicators honoured Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Webflow No offline_access in advertised scopes Unknown Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.webflow.com/.well-known/oauth-protected-resource/sse — HTTP 200; scopes_supported: absent, so no scope is advertised to judge Revision 2026-07-28	Unknown Webflow 401 for missing or invalid tokens Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Webflow Audience validation Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Webflow Bearer token only in the Authorization header Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported Webflow All endpoints served over HTTPS Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.webflow.com/.well-known/oauth-authorization-server — HTTP 200; all 4 endpoints use https Revision 2026-07-28	Unknown Webflow No token passthrough to upstream APIs Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Webflow Per-client consent on proxy servers Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.
Wix CAccess: publicAuth: oauth	Supported Wix Metadata issuer matches the discovery URL Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.wix.com/.well-known/oauth-authorization-server — HTTP 200; issuer: https://mcp.wix.com equals the issuer the PRM named Revision 2026-07-28	Supported Wix Authorization server metadata discoverable Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.wix.com/.well-known/oauth-authorization-server — HTTP 200; issuer: https://mcp.wix.com Revision 2026-07-28	Supported Wix Protected Resource Metadata served Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.wix.com/.well-known/oauth-protected-resource — HTTP 200; resource: https://mcp.wix.com Revision 2026-07-28	Supported Wix PRM lists an authorization server Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.wix.com/.well-known/oauth-protected-resource — HTTP 200; authorization_servers: [https://mcp.wix.com] Revision 2026-07-28	Supported Wix PRM lists scopes_supported Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.wix.com/.well-known/oauth-protected-resource — HTTP 200; scopes_supported: [offline_access] Revision 2026-07-28	Supported Wix PRM reachable at a well-known URI Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.wix.com/.well-known/oauth-protected-resource — HTTP 200; found at the root location Revision 2026-07-28	Supported Wix resource_metadata in the 401 challenge Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.wix.com/sse — HTTP 401; WWW-Authenticate resource_metadata: https://mcp.wix.com/.well-known/oauth-protected-resource Revision 2026-07-28	Unsupported Wix Client ID Metadata Documents supported Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.wix.com/.well-known/oauth-authorization-server — HTTP 200; client_id_metadata_document_supported: absent Revision 2026-07-28	Supported Wix Dynamic Client Registration offered Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.wix.com/.well-known/oauth-authorization-server — HTTP 200; registration_endpoint: https://mcp.wix.com/register Revision 2026-07-28	Unknown Wix Documented pre-registration path Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unsupported Wix Issuer identifier in authorization responses Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.wix.com/.well-known/oauth-authorization-server — HTTP 200; authorization_response_iss_parameter_supported: absent Revision 2026-07-28	Supported Wix PKCE with S256 advertised Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.wix.com/.well-known/oauth-authorization-server — HTTP 200; code_challenge_methods_supported: [plain, S256] Revision 2026-07-28	Unknown Wix 403 insufficient_scope for step-up Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unsupported Wix Scope in the WWW-Authenticate challenge Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.wix.com/sse — HTTP 401; WWW-Authenticate: Bearer realm="OAuth", error="invalid_token", error_description="Missing or invalid access token", resource_metadata="https://mcp.wix.com/.well-known/oauth-protected-resource", no scope parameter Revision 2026-07-28	Unknown Wix Refresh token rotation for public clients Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Wix Resource indicators honoured Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unsupported Wix No offline_access in advertised scopes Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.wix.com/.well-known/oauth-protected-resource — HTTP 200; scopes_supported includes offline_access: [offline_access] Revision 2026-07-28	Unknown Wix 401 for missing or invalid tokens Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Wix Audience validation Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Wix Bearer token only in the Authorization header Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported Wix All endpoints served over HTTPS Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.wix.com/.well-known/oauth-authorization-server — HTTP 200; all 4 endpoints use https Revision 2026-07-28	Unknown Wix No token passthrough to upstream APIs Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Wix Per-client consent on proxy servers Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.
Zapier CAccess: publicAuth: oauth	Supported Zapier Metadata issuer matches the discovery URL Supported Method passive-scan Observed 2026-10-18 by scanner@0.3.0 Evidence https://mcp.zapier.com/.well-known/oauth-authorization-server — HTTP 200; issuer: https://mcp.zapier.com equals the issuer the PRM named Revision 2026-07-28	Supported Zapier Authorization server metadata discoverable Supported Method passive-scan Observed 2026-10-18 by scanner@0.3.0 Evidence https://mcp.zapier.com/.well-known/oauth-authorization-server — HTTP 200; issuer: https://mcp.zapier.com Revision 2026-07-28	Supported Zapier Protected Resource Metadata served Supported Method passive-scan Observed 2026-10-18 by scanner@0.3.0 Evidence https://mcp.zapier.com/.well-known/oauth-protected-resource/api/mcp/mcp — HTTP 200; resource: https://mcp.zapier.com/api/mcp/mcp Revision 2026-07-28	Supported Zapier PRM lists an authorization server Supported Method passive-scan Observed 2026-10-18 by scanner@0.3.0 Evidence https://mcp.zapier.com/.well-known/oauth-protected-resource/api/mcp/mcp — HTTP 200; authorization_servers: [https://mcp.zapier.com] Revision 2026-07-28	Supported Zapier PRM lists scopes_supported Supported Method passive-scan Observed 2026-10-18 by scanner@0.3.0 Evidence https://mcp.zapier.com/.well-known/oauth-protected-resource/api/mcp/mcp — HTTP 200; scopes_supported: [openid, profile, email] Revision 2026-07-28	Supported Zapier PRM reachable at a well-known URI Supported Method passive-scan Observed 2026-10-18 by scanner@0.3.0 Evidence https://mcp.zapier.com/.well-known/oauth-protected-resource/api/mcp/mcp — HTTP 200; found at the path-aware location Revision 2026-07-28	Unsupported Zapier resource_metadata in the 401 challenge Unsupported Method passive-scan Observed 2026-10-18 by scanner@0.3.0 Evidence https://mcp.zapier.com/api/mcp/mcp — HTTP 401; WWW-Authenticate: Bearer realm="Zapier MCP", error="invalid_token", no resource_metadata parameter Revision 2026-07-28	Unsupported Zapier Client ID Metadata Documents supported Unsupported Method passive-scan Observed 2026-10-18 by scanner@0.3.0 Evidence https://mcp.zapier.com/.well-known/oauth-authorization-server — HTTP 200; client_id_metadata_document_supported: absent Revision 2026-07-28	Supported Zapier Dynamic Client Registration offered Supported Method passive-scan Observed 2026-10-18 by scanner@0.3.0 Evidence https://mcp.zapier.com/.well-known/oauth-authorization-server — HTTP 200; registration_endpoint: https://mcp.zapier.com/api/v1/oauth/register Revision 2026-07-28	Not applicable Zapier Documented pre-registration path Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as API Key; no OAuth authorization server is involved. Revision 2026-07-28	Unsupported Zapier Issuer identifier in authorization responses Unsupported Method passive-scan Observed 2026-10-18 by scanner@0.3.0 Evidence https://mcp.zapier.com/.well-known/oauth-authorization-server — HTTP 200; authorization_response_iss_parameter_supported: absent Revision 2026-07-28	Supported Zapier PKCE with S256 advertised Supported Method passive-scan Observed 2026-10-18 by scanner@0.3.0 Evidence https://mcp.zapier.com/.well-known/oauth-authorization-server — HTTP 200; code_challenge_methods_supported: [S256] Revision 2026-07-28	Not applicable Zapier 403 insufficient_scope for step-up Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as API Key; no OAuth authorization server is involved. Revision 2026-07-28	Unsupported Zapier Scope in the WWW-Authenticate challenge Unsupported Method passive-scan Observed 2026-10-18 by scanner@0.3.0 Evidence https://mcp.zapier.com/api/mcp/mcp — HTTP 401; WWW-Authenticate: Bearer realm="Zapier MCP", error="invalid_token", no scope parameter Revision 2026-07-28	Not applicable Zapier Refresh token rotation for public clients Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as API Key; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable Zapier Resource indicators honoured Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as API Key; no OAuth authorization server is involved. Revision 2026-07-28	Supported Zapier No offline_access in advertised scopes Supported Method passive-scan Observed 2026-10-18 by scanner@0.3.0 Evidence https://mcp.zapier.com/.well-known/oauth-protected-resource/api/mcp/mcp — HTTP 200; scopes_supported without offline_access: [openid, profile, email] Revision 2026-07-28	Not applicable Zapier 401 for missing or invalid tokens Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as API Key; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable Zapier Audience validation Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as API Key; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable Zapier Bearer token only in the Authorization header Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as API Key; no OAuth authorization server is involved. Revision 2026-07-28	Supported Zapier All endpoints served over HTTPS Supported Method passive-scan Observed 2026-10-18 by scanner@0.3.0 Evidence https://mcp.zapier.com/.well-known/oauth-authorization-server — HTTP 200; all 5 endpoints use https Revision 2026-07-28	Not applicable Zapier No token passthrough to upstream APIs Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as API Key; no OAuth authorization server is involved. Revision 2026-07-28	Not applicable Zapier Per-client consent on proxy servers Not applicable Method vendor-claim Observed 2026-10-13 by jbspeakr Evidence https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as API Key; no OAuth authorization server is involved. Revision 2026-07-28
Zoom CAccess: closedAuth: oauth	Supported Zoom Metadata issuer matches the discovery URL Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://zoom.us/.well-known/oauth-authorization-server — HTTP 200; issuer: https://zoom.us equals the issuer the PRM named Revision 2026-07-28	Supported Zoom Authorization server metadata discoverable Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://zoom.us/.well-known/oauth-authorization-server — HTTP 200; issuer: https://zoom.us Revision 2026-07-28	Supported Zoom Protected Resource Metadata served Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.zoom.us/.well-known/oauth-protected-resource/mcp/zoom/streamable — HTTP 200; resource: https://mcp.zoom.us/mcp/zoom/streamable Revision 2026-07-28	Supported Zoom PRM lists an authorization server Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.zoom.us/.well-known/oauth-protected-resource/mcp/zoom/streamable — HTTP 200; authorization_servers: [https://zoom.us] Revision 2026-07-28	Supported Zoom PRM lists scopes_supported Supported Method passive-scan Observed 2026-10-18 by scanner@0.3.0 Evidence https://mcp.zoom.us/.well-known/oauth-protected-resource/mcp/zoom/streamable — HTTP 200; scopes_supported: [docs:read:export, agentic_search:read:search, my_notes:read:content, meeting:update:in_meeting_controls, docs:write:import, cloud_recording:read:content, docs:read:list_file_collaborators, do… Revision 2026-07-28	Supported Zoom PRM reachable at a well-known URI Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.zoom.us/.well-known/oauth-protected-resource/mcp/zoom/streamable — HTTP 200; found at the path-aware location Revision 2026-07-28	Supported Zoom resource_metadata in the 401 challenge Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.zoom.us/mcp/zoom/streamable — HTTP 401; WWW-Authenticate resource_metadata: https://mcp.zoom.us/.well-known/oauth-protected-resource/mcp/zoom/streamable Revision 2026-07-28	Unsupported Zoom Client ID Metadata Documents supported Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://zoom.us/.well-known/oauth-authorization-server — HTTP 200; client_id_metadata_document_supported: absent Revision 2026-07-28	Unsupported Zoom Dynamic Client Registration offered Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://zoom.us/.well-known/oauth-authorization-server — HTTP 200; registration_endpoint: absent Revision 2026-07-28	Supported Zoom Documented pre-registration path Supported Method vendor-claim Observed 2026-10-14 by jbspeakr (documentation pass with Claude Code) Evidence https://developers.zoom.us/docs/mcp/servers/connect-to-zoom-mcp-servers/ — "Zoom remote MCP servers require manual client registration. [...] Get from your Zoom app's configuration page on the Zoom App Marketplace." (Client developer creates an app in the Zoom App Marketplace, takes the OAuth Client ID and Client Secret from the app's Basic information page, and enters the MCP client's callback in the OAuth redirect URL field (examples given for Claude and ChatGPT).) Revision 2026-07-28	Unsupported Zoom Issuer identifier in authorization responses Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://zoom.us/.well-known/oauth-authorization-server — HTTP 200; authorization_response_iss_parameter_supported: absent Revision 2026-07-28	Supported Zoom PKCE with S256 advertised Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://zoom.us/.well-known/oauth-authorization-server — HTTP 200; code_challenge_methods_supported: [S256] Revision 2026-07-28	Unknown Zoom 403 insufficient_scope for step-up Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unsupported Zoom Scope in the WWW-Authenticate challenge Unsupported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://mcp.zoom.us/mcp/zoom/streamable — HTTP 401; WWW-Authenticate: Bearer resource_metadata="https://mcp.zoom.us/.well-known/oauth-protected-resource/mcp/zoom/streamable", no scope parameter Revision 2026-07-28	Unknown Zoom Refresh token rotation for public clients Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Zoom Resource indicators honoured Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Supported Zoom No offline_access in advertised scopes Supported Method passive-scan Observed 2026-10-18 by scanner@0.3.0 Evidence https://mcp.zoom.us/.well-known/oauth-protected-resource/mcp/zoom/streamable — HTTP 200; scopes_supported without offline_access: [docs:read:export, agentic_search:read:search, my_notes:read:content, meeting:update:in_meeting_controls, docs:write:import, cloud_recording:read:content, docs:read:list… Revision 2026-07-28	Unknown Zoom 401 for missing or invalid tokens Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Zoom Audience validation Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Partial Zoom Bearer token only in the Authorization header Partial Method vendor-claim Observed 2026-10-14 by jbspeakr (documentation pass with Claude Code) Evidence https://developers.zoom.us/docs/mcp/servers/connect-to-zoom-mcp-servers/ — "Once you have the access token, your MCP client must include it as a Bearer token in the Authorization header for all requests to the Zoom MCP server." (Docs require the Authorization header; they do not say whether tokens in the query string are rejected.) Revision 2026-07-28	Supported Zoom All endpoints served over HTTPS Supported Method passive-scan Observed 2026-10-17 by scanner@0.3.0 Evidence https://zoom.us/.well-known/oauth-authorization-server — HTTP 200; all 2 endpoints use https Revision 2026-07-28	Unknown Zoom No token passthrough to upstream APIs Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.	Unknown Zoom Per-client consent on proxy servers Unknown no observation No observation recorded for this server and feature under revision 2026-07-28. Unknown means nobody has looked yet, not that the feature is missing.