MatrixRecord of · MCP Authorization 2026-07-28

Mixpanel

How it meets the 23 requirements of MCP Authorization.

Supported
11
Unsupported
3
Unknown, recorded
0
Not observed yet
9
Endpoint
https://mcp.mixpanel.com/mcp
Transport
Streamable HTTP
Access
Public Anyone can connect; where an account is needed, anyone can create one by self-service sign-up. Manual check · jbspeakr (documentation pass with Claude Code) · · evidence · On free and growth accounts created after 2026-08-01 MCP is on by default; on other accounts an organization admin turns it on under Settings › Org › AI Settings.
Auth
OAuth An OAuth 2.x authorization obtained through the server's authorization server. Manual check · jbspeakr (documentation pass with Claude Code) · · evidence · OAuth with RFC 9728 and RFC 8414 discovery, dynamic client registration and authorization code with PKCE (S256); service accounts send a static credential header (beta).
Why it is listed
Added by the atlas maintainer from the vendor's own documentation. Source
Homepage
https://mixpanel.com
Notes
Regional endpoints with their own authorization servers: https://mcp-eu.mixpanel.com/mcp (EU) and https://mcp-in.mixpanel.com/mcp (IN). The atlas lists the US endpoint.

Against MCP Authorization 2026-07-28current

  • Supported 11
  • Unsupported 3
  • Unknown 9

Passive scan · Requests

  • MUST8 supported
  • SHOULD1 supported, 3 unsupported
  • MAY2 supported

Contribute a correctionWithdraw this serverJSON

Older revisions of the matrix: 2025-11-25

MCP server features 13

FeatureLevelStatusObservedEvidence
Protected Resource Metadata servedmcp.prm · Discovery · Authorization Server Discovery › Authorization Server LocationMUSTSupportedPassive scan · scanner@0.4.0source— HTTP 200; resource: https://mcp.mixpanel.com/mcp
PRM lists an authorization servermcp.prm.authorization-servers · Discovery · Authorization Server Discovery › Authorization Server LocationMUSTSupportedPassive scan · scanner@0.4.0source— HTTP 200; authorization_servers: [https://auth.mixpanel.com]
PRM lists scopes_supportedmcp.prm.scopes-supported · Discovery · Authorization › Scope Selection StrategyMAYSupportedPassive scan · scanner@0.4.0source— HTTP 200; scopes_supported: [alerts, analysis, annotations, bookmarks, business_context, cohorts, context, custom_alerts, custom_events, custom_properties, dashboard_reports, data:read, data_definitions, events, experiments, featur…
PRM reachable at a well-known URImcp.prm.well-known · Discovery · Authorization Server Discovery › Protected Resource Metadata Discovery RequirementsMUSTSupportedPassive scan · scanner@0.4.0source— HTTP 200; found at the path-aware location
resource_metadata in the 401 challengemcp.prm.www-authenticate · Discovery · Authorization Server Discovery › Protected Resource Metadata Discovery RequirementsMUSTSupportedPassive scan · scanner@0.4.0source— HTTP 401; WWW-Authenticate resource_metadata: https://mcp.mixpanel.com/.well-known/oauth-protected-resource/mcp
403 insufficient_scope for step-upmcp.rs.insufficient-scope · Authorization · Authorization › Scope Challenge HandlingSHOULDUnknown no observationno observation yet
Scope in the WWW-Authenticate challengemcp.rs.scope-challenge · Authorization · Authorization › Scope Selection StrategySHOULDUnsupportedPassive scan · scanner@0.4.0source— HTTP 401; WWW-Authenticate: Bearer error="invalid_token", error_description="Authentication failed. The provided bearer token is invalid, expired, or no longer recognized by the server. To resolve: clear authentication tokens in your MCP client and reconnect. Your cli…
No offline_access in advertised scopesmcp.prm.no-offline-access · Tokens · Authorization › Refresh TokensSHOULDSupportedPassive scan · scanner@0.4.0source— HTTP 200; scopes_supported without offline_access: [alerts, analysis, annotations, bookmarks, business_context, cohorts, context, custom_alerts, custom_events, custom_properties, dashboard_reports, data:read, data_definitions, even…
401 for missing or invalid tokensmcp.rs.401-on-invalid · Tokens · Authorization › Token HandlingMUSTUnknown no observationno observation yet
Audience validationmcp.rs.audience-validation · Tokens · Security Considerations › Access Token Privilege RestrictionMUSTUnknown no observationno observation yet
Bearer token only in the Authorization headermcp.rs.bearer-header · Tokens · Authorization › Access Token UsageMUSTUnknown no observationno observation yet
No token passthrough to upstream APIsmcp.rs.no-passthrough · Delegation · Security Considerations › Access Token Privilege RestrictionMUSTUnknown no observationno observation yet
Per-client consent on proxy serversmcp.proxy.consent · Consent · Security Considerations › Confused Deputy ProblemMUSTUnknown no observationno observation yet

Authorization server features 10

FeatureLevelStatusObservedEvidence
Metadata issuer matches the discovery URLmcp.as.issuer-match · Discovery · Authorization Server Discovery › Authorization Server Metadata DiscoveryMUSTSupportedPassive scan · scanner@0.4.0source— HTTP 200; issuer: https://auth.mixpanel.com equals the issuer the PRM named
Authorization server metadata discoverablemcp.as.metadata · Discovery · Authorization Server Discovery › Authorization Server Metadata DiscoveryMUSTSupportedPassive scan · scanner@0.4.0source— HTTP 200; issuer: https://auth.mixpanel.com
Client ID Metadata Documents supportedmcp.as.cimd · Registration · Client Registration › Client ID Metadata DocumentsSHOULDUnsupportedPassive scan · scanner@0.4.0source— HTTP 200; client_id_metadata_document_supported: absent
Dynamic Client Registration offeredmcp.as.dcr · Registration · Client Registration › Dynamic Client RegistrationMAYSupportedPassive scan · scanner@0.4.0source— HTTP 200; registration_endpoint: https://mixpanel.com/oauth/mcp/register/
Documented pre-registration pathmcp.as.preregistration · Registration · Client Registration › Pre-registrationSHOULDUnknown no observationno observation yet
Issuer identifier in authorization responsesmcp.as.iss-param · Authorization · Authorization › Authorization Response ValidationSHOULDUnsupportedPassive scan · scanner@0.4.0source— HTTP 200; authorization_response_iss_parameter_supported: absent
PKCE with S256 advertisedmcp.as.pkce-s256 · Authorization · Security Considerations › Authorization Code ProtectionMUSTSupportedPassive scan · scanner@0.4.0source— HTTP 200; code_challenge_methods_supported: [S256]
Refresh token rotation for public clientsmcp.as.refresh-rotation · Tokens · Security Considerations › Token TheftMUSTUnknown no observationno observation yet
Resource indicators honouredmcp.as.resource-indicator · Tokens · Security Considerations › Token Audience Binding and ValidationMUSTUnknown no observationno observation yet
All endpoints served over HTTPSmcp.as.https · Transport · Security Considerations › Communication SecurityMUSTSupportedPassive scan · scanner@0.4.0source— HTTP 200; all 3 endpoints use https

This server's ledger

No status change on record

Every cell of this server still shows the status of its first observation.

The whole ledger

What the scanner asked

The requests behind the rows marked passive scan above, in the order the scanner makes them, each with the newest answer recorded. None carries a credential or a message.

  1. GEThttps://mcp.mixpanel.com/.well-known/oauth-protected-resource/mcpHTTP 200read resource, authorization_servers, scopes_supported
  2. GEThttps://mcp.mixpanel.com/mcpHTTP 401read status, WWW-Authenticate
  3. GEThttps://auth.mixpanel.com/.well-known/oauth-authorization-serverHTTP 200read issuer, client_id_metadata_document_supported, registration_endpoint, authorization_response_iss_parameter_supported, code_challenge_methods_supported
  4. 14 checks, read into the tables above

Newest scanner observation · letsauth-scanner/0.4.0 · reproduce with pnpm scan mixpanel · scan JSON · data file · how the scanner works