{
  "version": 2,
  "scanner": "letsauth-scanner/0.4.0",
  "generatedAt": "2026-11-12T12:42:01.235Z",
  "recorded": true,
  "target": {
    "url": "https://mcp.datadoghq.com/v1/mcp",
    "server": "datadog"
  },
  "revision": {
    "spec": "mcp-authorization",
    "revision": "2026-07-28"
  },
  "method": "passive-scan",
  "requests": [],
  "discovered": null,
  "checks": [
    {
      "feature": "mcp.prm",
      "name": "Protected Resource Metadata served",
      "party": "mcp-server",
      "level": "MUST",
      "section": "Authorization Server Discovery › Authorization Server Location",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "supported",
      "evidence": "https://mcp.datadoghq.com/.well-known/oauth-protected-resource/v1/mcp — HTTP 200; resource: https://mcp.datadoghq.com/v1/mcp",
      "observedAt": "2026-11-12T02:19:33Z"
    },
    {
      "feature": "mcp.prm.authorization-servers",
      "name": "PRM lists an authorization server",
      "party": "mcp-server",
      "level": "MUST",
      "section": "Authorization Server Discovery › Authorization Server Location",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "supported",
      "evidence": "https://mcp.datadoghq.com/.well-known/oauth-protected-resource/v1/mcp — HTTP 200; authorization_servers: [https://mcp.datadoghq.com/v1/mcp]",
      "observedAt": "2026-11-12T02:19:33Z"
    },
    {
      "feature": "mcp.prm.scopes-supported",
      "name": "PRM lists scopes_supported",
      "party": "mcp-server",
      "level": "MAY",
      "section": "Authorization › Scope Selection Strategy",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "unsupported",
      "evidence": "https://mcp.datadoghq.com/.well-known/oauth-protected-resource/v1/mcp — HTTP 200; scopes_supported: absent",
      "observedAt": "2026-11-12T02:19:33Z"
    },
    {
      "feature": "mcp.prm.well-known",
      "name": "PRM reachable at a well-known URI",
      "party": "mcp-server",
      "level": "MUST",
      "levelNote": "One of two discovery mechanisms the server must offer.",
      "section": "Authorization Server Discovery › Protected Resource Metadata Discovery Requirements",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "supported",
      "evidence": "https://mcp.datadoghq.com/.well-known/oauth-protected-resource/v1/mcp — HTTP 200; found at the path-aware location",
      "observedAt": "2026-11-12T02:19:33Z"
    },
    {
      "feature": "mcp.prm.www-authenticate",
      "name": "resource_metadata in the 401 challenge",
      "party": "mcp-server",
      "level": "MUST",
      "levelNote": "One of two discovery mechanisms the server must offer.",
      "section": "Authorization Server Discovery › Protected Resource Metadata Discovery Requirements",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "supported",
      "evidence": "https://mcp.datadoghq.com/v1/mcp — HTTP 401; WWW-Authenticate resource_metadata: https://mcp.datadoghq.com/.well-known/oauth-protected-resource/v1/mcp",
      "observedAt": "2026-11-12T02:19:33Z"
    },
    {
      "feature": "mcp.rs.scope-challenge",
      "name": "Scope in the WWW-Authenticate challenge",
      "party": "mcp-server",
      "level": "SHOULD",
      "section": "Authorization › Scope Selection Strategy",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "unsupported",
      "evidence": "https://mcp.datadoghq.com/v1/mcp — HTTP 401; WWW-Authenticate: Bearer resource_metadata=\"https://mcp.datadoghq.com/.well-known/oauth-protected-resource/v1/mcp\", no scope parameter",
      "observedAt": "2026-11-12T02:19:33Z"
    },
    {
      "feature": "mcp.prm.no-offline-access",
      "name": "No offline_access in advertised scopes",
      "party": "mcp-server",
      "level": "SHOULD",
      "section": "Authorization › Refresh Tokens",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "unknown",
      "evidence": "https://mcp.datadoghq.com/.well-known/oauth-protected-resource/v1/mcp — HTTP 200; scopes_supported: absent, so no scope is advertised to judge",
      "observedAt": "2026-11-12T02:19:33Z"
    },
    {
      "feature": "mcp.as.issuer-match",
      "name": "Metadata issuer matches the discovery URL",
      "party": "authorization-server",
      "level": "MUST",
      "section": "Authorization Server Discovery › Authorization Server Metadata Discovery",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "supported",
      "evidence": "https://mcp.datadoghq.com/.well-known/oauth-authorization-server/v1/mcp — HTTP 200; issuer: https://mcp.datadoghq.com/v1/mcp equals the issuer the PRM named",
      "observedAt": "2026-11-12T02:19:33Z"
    },
    {
      "feature": "mcp.as.metadata",
      "name": "Authorization server metadata discoverable",
      "party": "authorization-server",
      "level": "MUST",
      "section": "Authorization Server Discovery › Authorization Server Metadata Discovery",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "supported",
      "evidence": "https://mcp.datadoghq.com/.well-known/oauth-authorization-server/v1/mcp — HTTP 200; issuer: https://mcp.datadoghq.com/v1/mcp",
      "observedAt": "2026-11-12T02:19:33Z"
    },
    {
      "feature": "mcp.as.cimd",
      "name": "Client ID Metadata Documents supported",
      "party": "authorization-server",
      "level": "SHOULD",
      "section": "Client Registration › Client ID Metadata Documents",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "unsupported",
      "evidence": "https://mcp.datadoghq.com/.well-known/oauth-authorization-server/v1/mcp — HTTP 200; client_id_metadata_document_supported: absent",
      "observedAt": "2026-11-12T02:19:33Z"
    },
    {
      "feature": "mcp.as.dcr",
      "name": "Dynamic Client Registration offered",
      "party": "authorization-server",
      "level": "MAY",
      "levelNote": "Deprecated; retained for compatibility with clients that cannot use Client ID Metadata Documents.",
      "section": "Client Registration › Dynamic Client Registration",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "supported",
      "evidence": "https://mcp.datadoghq.com/.well-known/oauth-authorization-server/v1/mcp — HTTP 200; registration_endpoint: https://app.datadoghq.com/api/v2/oauth2/register",
      "observedAt": "2026-11-12T02:19:33Z"
    },
    {
      "feature": "mcp.as.iss-param",
      "name": "Issuer identifier in authorization responses",
      "party": "authorization-server",
      "level": "SHOULD",
      "section": "Authorization › Authorization Response Validation",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "unsupported",
      "evidence": "https://mcp.datadoghq.com/.well-known/oauth-authorization-server/v1/mcp — HTTP 200; authorization_response_iss_parameter_supported: absent",
      "observedAt": "2026-11-12T02:19:33Z"
    },
    {
      "feature": "mcp.as.pkce-s256",
      "name": "PKCE with S256 advertised",
      "party": "authorization-server",
      "level": "MUST",
      "section": "Security Considerations › Authorization Code Protection",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "supported",
      "evidence": "https://mcp.datadoghq.com/.well-known/oauth-authorization-server/v1/mcp — HTTP 200; code_challenge_methods_supported: [S256]",
      "observedAt": "2026-11-12T02:19:33Z"
    },
    {
      "feature": "mcp.as.https",
      "name": "All endpoints served over HTTPS",
      "party": "authorization-server",
      "level": "MUST",
      "section": "Security Considerations › Communication Security",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "supported",
      "evidence": "https://mcp.datadoghq.com/.well-known/oauth-authorization-server/v1/mcp — HTTP 200; all 3 endpoints use https",
      "observedAt": "2026-11-12T02:19:33Z"
    }
  ],
  "summary": {
    "state": "scanned",
    "label": "MUST 8 supported · SHOULD 3 unsupported, 1 unknown · MAY 1 supported, 1 unsupported",
    "tallies": [
      {
        "level": "MUST",
        "total": 8,
        "counts": [
          {
            "status": "supported",
            "n": 8
          }
        ]
      },
      {
        "level": "SHOULD",
        "total": 4,
        "counts": [
          {
            "status": "unsupported",
            "n": 3
          },
          {
            "status": "unknown",
            "n": 1
          }
        ]
      },
      {
        "level": "MAY",
        "total": 2,
        "counts": [
          {
            "status": "supported",
            "n": 1
          },
          {
            "status": "unsupported",
            "n": 1
          }
        ]
      }
    ],
    "open": [
      {
        "feature": "mcp.prm.scopes-supported",
        "name": "PRM lists scopes_supported",
        "level": "MAY",
        "status": "unsupported"
      },
      {
        "feature": "mcp.rs.scope-challenge",
        "name": "Scope in the WWW-Authenticate challenge",
        "level": "SHOULD",
        "status": "unsupported"
      },
      {
        "feature": "mcp.prm.no-offline-access",
        "name": "No offline_access in advertised scopes",
        "level": "SHOULD",
        "status": "unknown"
      },
      {
        "feature": "mcp.as.cimd",
        "name": "Client ID Metadata Documents supported",
        "level": "SHOULD",
        "status": "unsupported"
      },
      {
        "feature": "mcp.as.iss-param",
        "name": "Issuer identifier in authorization responses",
        "level": "SHOULD",
        "status": "unsupported"
      }
    ],
    "notes": []
  },
  "observations": []
}