{
  "version": 1,
  "scanner": "letsauth-scanner/0.4.0",
  "generatedAt": "2026-10-19T21:16:21.981Z",
  "recorded": true,
  "target": {
    "url": "https://ramp-mcp-remote.ramp.com/mcp",
    "server": "ramp"
  },
  "revision": {
    "spec": "mcp-authorization",
    "revision": "2026-07-28"
  },
  "method": "passive-scan",
  "requests": [],
  "discovered": null,
  "checks": [
    {
      "feature": "mcp.prm",
      "name": "Protected Resource Metadata served",
      "party": "mcp-server",
      "level": "MUST",
      "section": "Authorization Server Discovery › Authorization Server Location",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "supported",
      "evidence": "https://ramp-mcp-remote.ramp.com/.well-known/oauth-protected-resource/mcp — HTTP 200; resource: https://ramp-mcp-remote.ramp.com/mcp",
      "observedAt": "2026-10-17T01:18:47Z"
    },
    {
      "feature": "mcp.prm.authorization-servers",
      "name": "PRM lists an authorization server",
      "party": "mcp-server",
      "level": "MUST",
      "section": "Authorization Server Discovery › Authorization Server Location",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "supported",
      "evidence": "https://ramp-mcp-remote.ramp.com/.well-known/oauth-protected-resource/mcp — HTTP 200; authorization_servers: [https://ramp-mcp-remote.ramp.com]",
      "observedAt": "2026-10-17T01:18:47Z"
    },
    {
      "feature": "mcp.prm.scopes-supported",
      "name": "PRM lists scopes_supported",
      "party": "mcp-server",
      "level": "MAY",
      "section": "Authorization › Scope Selection Strategy",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "supported",
      "evidence": "https://ramp-mcp-remote.ramp.com/.well-known/oauth-protected-resource/mcp — HTTP 200; scopes_supported: [bills:read, cards:read, departments:read, entities:read, limits:read, locations:read, memos:read, purchase_orders:read, reimbursements:read, spend_programs:read, transactions:read, users:read, v…",
      "observedAt": "2026-10-17T01:18:47Z"
    },
    {
      "feature": "mcp.prm.well-known",
      "name": "PRM reachable at a well-known URI",
      "party": "mcp-server",
      "level": "MUST",
      "levelNote": "One of two discovery mechanisms the server must offer.",
      "section": "Authorization Server Discovery › Protected Resource Metadata Discovery Requirements",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "supported",
      "evidence": "https://ramp-mcp-remote.ramp.com/.well-known/oauth-protected-resource/mcp — HTTP 200; found at the path-aware location",
      "observedAt": "2026-10-17T01:18:47Z"
    },
    {
      "feature": "mcp.prm.www-authenticate",
      "name": "resource_metadata in the 401 challenge",
      "party": "mcp-server",
      "level": "MUST",
      "levelNote": "One of two discovery mechanisms the server must offer.",
      "section": "Authorization Server Discovery › Protected Resource Metadata Discovery Requirements",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "supported",
      "evidence": "https://ramp-mcp-remote.ramp.com/mcp — HTTP 401; WWW-Authenticate resource_metadata: https://ramp-mcp-remote.ramp.com/.well-known/oauth-protected-resource/mcp",
      "observedAt": "2026-10-17T01:18:47Z"
    },
    {
      "feature": "mcp.rs.scope-challenge",
      "name": "Scope in the WWW-Authenticate challenge",
      "party": "mcp-server",
      "level": "SHOULD",
      "section": "Authorization › Scope Selection Strategy",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "unsupported",
      "evidence": "https://ramp-mcp-remote.ramp.com/mcp — HTTP 401; WWW-Authenticate: Bearer resource_metadata=\"https://ramp-mcp-remote.ramp.com/.well-known/oauth-protected-resource/mcp\", no scope parameter",
      "observedAt": "2026-10-17T01:18:47Z"
    },
    {
      "feature": "mcp.prm.no-offline-access",
      "name": "No offline_access in advertised scopes",
      "party": "mcp-server",
      "level": "SHOULD",
      "section": "Authorization › Refresh Tokens",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "supported",
      "evidence": "https://ramp-mcp-remote.ramp.com/.well-known/oauth-protected-resource/mcp — HTTP 200; scopes_supported without offline_access: [bills:read, cards:read, departments:read, entities:read, limits:read, locations:read, memos:read, purchase_orders:read, reimbursements:read, spend_programs:read, transacti…",
      "observedAt": "2026-10-17T01:18:47Z"
    },
    {
      "feature": "mcp.as.issuer-match",
      "name": "Metadata issuer matches the discovery URL",
      "party": "authorization-server",
      "level": "MUST",
      "section": "Authorization Server Discovery › Authorization Server Metadata Discovery",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "supported",
      "evidence": "https://ramp-mcp-remote.ramp.com/.well-known/oauth-authorization-server — HTTP 200; issuer: https://ramp-mcp-remote.ramp.com equals the issuer the PRM named",
      "observedAt": "2026-10-17T01:18:47Z"
    },
    {
      "feature": "mcp.as.metadata",
      "name": "Authorization server metadata discoverable",
      "party": "authorization-server",
      "level": "MUST",
      "section": "Authorization Server Discovery › Authorization Server Metadata Discovery",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "supported",
      "evidence": "https://ramp-mcp-remote.ramp.com/.well-known/oauth-authorization-server — HTTP 200; issuer: https://ramp-mcp-remote.ramp.com",
      "observedAt": "2026-10-17T01:18:47Z"
    },
    {
      "feature": "mcp.as.cimd",
      "name": "Client ID Metadata Documents supported",
      "party": "authorization-server",
      "level": "SHOULD",
      "section": "Client Registration › Client ID Metadata Documents",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "unsupported",
      "evidence": "https://ramp-mcp-remote.ramp.com/.well-known/oauth-authorization-server — HTTP 200; client_id_metadata_document_supported: absent",
      "observedAt": "2026-10-17T01:18:47Z"
    },
    {
      "feature": "mcp.as.dcr",
      "name": "Dynamic Client Registration offered",
      "party": "authorization-server",
      "level": "MAY",
      "levelNote": "Deprecated; retained for compatibility with clients that cannot use Client ID Metadata Documents.",
      "section": "Client Registration › Dynamic Client Registration",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "supported",
      "evidence": "https://ramp-mcp-remote.ramp.com/.well-known/oauth-authorization-server — HTTP 200; registration_endpoint: https://ramp-mcp-remote.ramp.com/register",
      "observedAt": "2026-10-17T01:18:47Z"
    },
    {
      "feature": "mcp.as.iss-param",
      "name": "Issuer identifier in authorization responses",
      "party": "authorization-server",
      "level": "SHOULD",
      "section": "Authorization › Authorization Response Validation",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "unsupported",
      "evidence": "https://ramp-mcp-remote.ramp.com/.well-known/oauth-authorization-server — HTTP 200; authorization_response_iss_parameter_supported: absent",
      "observedAt": "2026-10-17T01:18:47Z"
    },
    {
      "feature": "mcp.as.pkce-s256",
      "name": "PKCE with S256 advertised",
      "party": "authorization-server",
      "level": "MUST",
      "section": "Security Considerations › Authorization Code Protection",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "supported",
      "evidence": "https://ramp-mcp-remote.ramp.com/.well-known/oauth-authorization-server — HTTP 200; code_challenge_methods_supported: [S256]",
      "observedAt": "2026-10-17T01:18:47Z"
    },
    {
      "feature": "mcp.as.https",
      "name": "All endpoints served over HTTPS",
      "party": "authorization-server",
      "level": "MUST",
      "section": "Security Considerations › Communication Security",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "supported",
      "evidence": "https://ramp-mcp-remote.ramp.com/.well-known/oauth-authorization-server — HTTP 200; all 4 endpoints use https",
      "observedAt": "2026-10-17T01:18:47Z"
    }
  ],
  "grade": {
    "letter": "C",
    "label": "C",
    "reasons": [
      "SHOULD-level check unsupported: Scope in the WWW-Authenticate challenge",
      "SHOULD-level check unsupported: Client ID Metadata Documents supported",
      "SHOULD-level check unsupported: Issuer identifier in authorization responses"
    ]
  },
  "observations": []
}