Server

Plaid

Endpoint
https://api.dashboard.plaid.com/mcp/
Transport
Streamable HTTP
Access
Closed Connecting needs something not available by self-service: an existing contract, a tenant an admin must enable, a sales process or a private beta. A catalog of approved clients is not one: any account connects through a listed client. Manual check · jbspeakr (documentation pass with Claude Code) · · evidence · Works with Production data only; the team must be approved for Production access with at least one Plaid product before using the server.
Auth
OAuth An OAuth 2.x authorization obtained through the server's authorization server. Manual check · jbspeakr (documentation pass with Claude Code) · · evidence · OAuth client_credentials token with scope mcp:dashboard from /oauth/token, sent as a bearer header and refreshed every 15 minutes.
Why it is listed
Listed because it appears in a public directory of MCP servers. Source
Homepage
https://plaid.com
Notes
The vendor's MCP page documents an OAuth 2.0 client_credentials grant with the team's client ID and production secret (scope mcp:dashboard); there is no user consent flow for MCP clients.

Against MCP Authorization 2026-07-28current

  • Partial 1
  • Unsupported 3
  • Unknown 19

Passive scanGrade F · · Report

Contribute a correctionWithdraw this serverJSON

Older revisions of the matrix: 2025-11-25

MCP server features 13

FeatureLevelStatusObservedEvidence
Protected Resource Metadata servedmcp.prm · Discovery · Authorization Server Discovery › Authorization Server LocationMUSTUnknownPassive scan · scanner@0.3.0source— HTTP 404; no protected resource metadata at a well-known location (HTTP 404, HTTP 404) and none reached through the challenge (challenge without resource_metadata)
1 earlier observation
  1. Unknown · Passive scan · scanner@0.2.0 · evidence
PRM lists an authorization servermcp.prm.authorization-servers · Discovery · Authorization Server Discovery › Authorization Server LocationMUSTUnknownPassive scan · scanner@0.3.0source— HTTP 404; no protected resource metadata at a well-known location (HTTP 404, HTTP 404) and none reached through the challenge (challenge without resource_metadata)
1 earlier observation
  1. Unknown · Passive scan · scanner@0.2.0 · evidence
PRM lists scopes_supportedmcp.prm.scopes-supported · Discovery · Authorization › Scope Selection StrategyMAYUnknownPassive scan · scanner@0.3.0source— HTTP 404; no protected resource metadata at a well-known location (HTTP 404, HTTP 404) and none reached through the challenge (challenge without resource_metadata)
1 earlier observation
  1. Unknown · Passive scan · scanner@0.2.0 · evidence
PRM reachable at a well-known URImcp.prm.well-known · Discovery · Authorization Server Discovery › Protected Resource Metadata Discovery RequirementsMUSTUnsupportedPassive scan · scanner@0.3.0source— HTTP 404; not at either well-known location (path-aware HTTP 404, root HTTP 404)
1 earlier observation
  1. Unsupported · Passive scan · scanner@0.2.0 · evidence
resource_metadata in the 401 challengemcp.prm.www-authenticate · Discovery · Authorization Server Discovery › Protected Resource Metadata Discovery RequirementsMUSTUnsupportedPassive scan · scanner@0.3.0source— HTTP 401; WWW-Authenticate: absent, no resource_metadata parameter
1 earlier observation
  1. Unsupported · Passive scan · scanner@0.2.0 · evidence
403 insufficient_scope for step-upmcp.rs.insufficient-scope · Authorization · Authorization › Scope Challenge HandlingSHOULDUnknown no observationno observation yet
Scope in the WWW-Authenticate challengemcp.rs.scope-challenge · Authorization · Authorization › Scope Selection StrategySHOULDUnsupportedPassive scan · scanner@0.3.0source— HTTP 401; WWW-Authenticate: absent, no scope parameter
No offline_access in advertised scopesmcp.prm.no-offline-access · Tokens · Authorization › Refresh TokensSHOULDUnknownPassive scan · scanner@0.3.0source— HTTP 404; no protected resource metadata at a well-known location (HTTP 404, HTTP 404) and none reached through the challenge (challenge without resource_metadata)
1 earlier observation
  1. Unknown · Passive scan · scanner@0.2.0 · evidence
401 for missing or invalid tokensmcp.rs.401-on-invalid · Tokens · Authorization › Token HandlingMUSTPartialVendor claim · jbspeakr (documentation pass with Claude Code)source— "Access tokens for the MCP server expire after 15 minutes." (Docs say expired tokens make MCP requests 'fail with a `401` status code or a provider-specific authentication error'; the 401 is stated for direct calls, missing/invalid tokens are not addressed.)
Audience validationmcp.rs.audience-validation · Tokens · Security Considerations › Access Token Privilege RestrictionMUSTUnknown no observationno observation yet
Bearer token only in the Authorization headermcp.rs.bearer-header · Tokens · Authorization › Access Token UsageMUSTUnknown no observationno observation yet
No token passthrough to upstream APIsmcp.rs.no-passthrough · Delegation · Security Considerations › Access Token Privilege RestrictionMUSTUnknown no observationno observation yet
Per-client consent on proxy serversmcp.proxy.consent · Consent · Security Considerations › Confused Deputy ProblemMUSTUnknown no observationno observation yet

Authorization server features 10

FeatureLevelStatusObservedEvidence
Metadata issuer matches the discovery URLmcp.as.issuer-match · Discovery · Authorization Server Discovery › Authorization Server Metadata DiscoveryMUSTUnknownPassive scan · scanner@0.3.0source— HTTP 404; no protected resource metadata at a well-known location (HTTP 404, HTTP 404) and none reached through the challenge (challenge without resource_metadata)
1 earlier observation
  1. Unknown · Passive scan · scanner@0.2.0 · evidence
Authorization server metadata discoverablemcp.as.metadata · Discovery · Authorization Server Discovery › Authorization Server Metadata DiscoveryMUSTUnknownPassive scan · scanner@0.3.0source— HTTP 404; no protected resource metadata at a well-known location (HTTP 404, HTTP 404) and none reached through the challenge (challenge without resource_metadata)
1 earlier observation
  1. Unknown · Passive scan · scanner@0.2.0 · evidence
Client ID Metadata Documents supportedmcp.as.cimd · Registration · Client Registration › Client ID Metadata DocumentsSHOULDUnknownPassive scan · scanner@0.3.0source— HTTP 404; no protected resource metadata at a well-known location (HTTP 404, HTTP 404) and none reached through the challenge (challenge without resource_metadata)
1 earlier observation
  1. Unknown · Passive scan · scanner@0.2.0 · evidence
Dynamic Client Registration offeredmcp.as.dcr · Registration · Client Registration › Dynamic Client RegistrationMAYUnknownPassive scan · scanner@0.3.0source— HTTP 404; no protected resource metadata at a well-known location (HTTP 404, HTTP 404) and none reached through the challenge (challenge without resource_metadata)
2 earlier observations
  1. Unknown · Passive scan · scanner@0.2.0 · evidence
  2. Unsupported · Vendor claim · jbspeakr · evidence
Documented pre-registration pathmcp.as.preregistration · Registration · Client Registration › Pre-registrationSHOULDUnknown no observationno observation yet
Issuer identifier in authorization responsesmcp.as.iss-param · Authorization · Authorization › Authorization Response ValidationSHOULDUnknownPassive scan · scanner@0.3.0source— HTTP 404; no protected resource metadata at a well-known location (HTTP 404, HTTP 404) and none reached through the challenge (challenge without resource_metadata)
1 earlier observation
  1. Unknown · Passive scan · scanner@0.2.0 · evidence
PKCE with S256 advertisedmcp.as.pkce-s256 · Authorization · Security Considerations › Authorization Code ProtectionMUSTUnknownPassive scan · scanner@0.3.0source— HTTP 404; no protected resource metadata at a well-known location (HTTP 404, HTTP 404) and none reached through the challenge (challenge without resource_metadata)
1 earlier observation
  1. Unknown · Passive scan · scanner@0.2.0 · evidence
Refresh token rotation for public clientsmcp.as.refresh-rotation · Tokens · Security Considerations › Token TheftMUSTUnknown no observationno observation yet
Resource indicators honouredmcp.as.resource-indicator · Tokens · Security Considerations › Token Audience Binding and ValidationMUSTUnknown no observationno observation yet
All endpoints served over HTTPSmcp.as.https · Transport · Security Considerations › Communication SecurityMUSTUnknownPassive scan · scanner@0.3.0source— HTTP 404; no protected resource metadata at a well-known location (HTTP 404, HTTP 404) and none reached through the challenge (challenge without resource_metadata)
1 earlier observation
  1. Unknown · Passive scan · scanner@0.2.0 · evidence