{
  "version": 2,
  "scanner": "letsauth-scanner/0.4.0",
  "generatedAt": "2026-11-12T12:42:01.266Z",
  "recorded": true,
  "target": {
    "url": "https://mcp.stytch.dev/mcp",
    "server": "stytch"
  },
  "revision": {
    "spec": "mcp-authorization",
    "revision": "2026-07-28"
  },
  "method": "passive-scan",
  "requests": [],
  "discovered": null,
  "checks": [
    {
      "feature": "mcp.prm",
      "name": "Protected Resource Metadata served",
      "party": "mcp-server",
      "level": "MUST",
      "section": "Authorization Server Discovery › Authorization Server Location",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "supported",
      "evidence": "https://mcp.stytch.dev/.well-known/oauth-protected-resource — HTTP 200; resource: https://mcp.stytch.dev",
      "observedAt": "2026-11-12T02:19:33Z"
    },
    {
      "feature": "mcp.prm.authorization-servers",
      "name": "PRM lists an authorization server",
      "party": "mcp-server",
      "level": "MUST",
      "section": "Authorization Server Discovery › Authorization Server Location",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "supported",
      "evidence": "https://mcp.stytch.dev/.well-known/oauth-protected-resource — HTTP 200; authorization_servers: [https://rustic-kilogram-6347.customers.stytch.com]",
      "observedAt": "2026-11-12T02:19:33Z"
    },
    {
      "feature": "mcp.prm.scopes-supported",
      "name": "PRM lists scopes_supported",
      "party": "mcp-server",
      "level": "MAY",
      "section": "Authorization › Scope Selection Strategy",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "supported",
      "evidence": "https://mcp.stytch.dev/.well-known/oauth-protected-resource — HTTP 200; scopes_supported: [admin:projects, email, manage:api_keys, manage:api_keys:test, manage:project_data, manage:project_settings, openid, profile]",
      "observedAt": "2026-11-12T02:19:33Z"
    },
    {
      "feature": "mcp.prm.well-known",
      "name": "PRM reachable at a well-known URI",
      "party": "mcp-server",
      "level": "MUST",
      "levelNote": "One of two discovery mechanisms the server must offer.",
      "section": "Authorization Server Discovery › Protected Resource Metadata Discovery Requirements",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "supported",
      "evidence": "https://mcp.stytch.dev/.well-known/oauth-protected-resource — HTTP 200; found at the root location",
      "observedAt": "2026-11-12T02:19:33Z"
    },
    {
      "feature": "mcp.prm.www-authenticate",
      "name": "resource_metadata in the 401 challenge",
      "party": "mcp-server",
      "level": "MUST",
      "levelNote": "One of two discovery mechanisms the server must offer.",
      "section": "Authorization Server Discovery › Protected Resource Metadata Discovery Requirements",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "supported",
      "evidence": "https://mcp.stytch.dev/mcp — HTTP 401; WWW-Authenticate resource_metadata: https://mcp.stytch.dev/.well-known/oauth-protected-resource",
      "observedAt": "2026-11-12T02:19:33Z"
    },
    {
      "feature": "mcp.rs.scope-challenge",
      "name": "Scope in the WWW-Authenticate challenge",
      "party": "mcp-server",
      "level": "SHOULD",
      "section": "Authorization › Scope Selection Strategy",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "unsupported",
      "evidence": "https://mcp.stytch.dev/mcp — HTTP 401; WWW-Authenticate: Bearer error=\"Unauthorized\", error_description=\"Unauthorized\", resource_metadata=\"https://mcp.stytch.dev/.well-known/oauth-protected-resource\", no scope parameter",
      "observedAt": "2026-11-12T02:19:33Z"
    },
    {
      "feature": "mcp.prm.no-offline-access",
      "name": "No offline_access in advertised scopes",
      "party": "mcp-server",
      "level": "SHOULD",
      "section": "Authorization › Refresh Tokens",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "supported",
      "evidence": "https://mcp.stytch.dev/.well-known/oauth-protected-resource — HTTP 200; scopes_supported without offline_access: [admin:projects, email, manage:api_keys, manage:api_keys:test, manage:project_data, manage:project_settings, openid, profile]",
      "observedAt": "2026-11-12T02:19:33Z"
    },
    {
      "feature": "mcp.as.issuer-match",
      "name": "Metadata issuer matches the discovery URL",
      "party": "authorization-server",
      "level": "MUST",
      "section": "Authorization Server Discovery › Authorization Server Metadata Discovery",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "supported",
      "evidence": "https://rustic-kilogram-6347.customers.stytch.com/.well-known/oauth-authorization-server — HTTP 200; issuer: https://rustic-kilogram-6347.customers.stytch.com equals the issuer the PRM named",
      "observedAt": "2026-11-12T02:19:33Z"
    },
    {
      "feature": "mcp.as.metadata",
      "name": "Authorization server metadata discoverable",
      "party": "authorization-server",
      "level": "MUST",
      "section": "Authorization Server Discovery › Authorization Server Metadata Discovery",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "supported",
      "evidence": "https://rustic-kilogram-6347.customers.stytch.com/.well-known/oauth-authorization-server — HTTP 200; issuer: https://rustic-kilogram-6347.customers.stytch.com",
      "observedAt": "2026-11-12T02:19:33Z"
    },
    {
      "feature": "mcp.as.cimd",
      "name": "Client ID Metadata Documents supported",
      "party": "authorization-server",
      "level": "SHOULD",
      "section": "Client Registration › Client ID Metadata Documents",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "supported",
      "evidence": "https://rustic-kilogram-6347.customers.stytch.com/.well-known/oauth-authorization-server — HTTP 200; client_id_metadata_document_supported: true",
      "observedAt": "2026-11-12T02:19:33Z"
    },
    {
      "feature": "mcp.as.dcr",
      "name": "Dynamic Client Registration offered",
      "party": "authorization-server",
      "level": "MAY",
      "levelNote": "Deprecated; retained for compatibility with clients that cannot use Client ID Metadata Documents.",
      "section": "Client Registration › Dynamic Client Registration",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "supported",
      "evidence": "https://rustic-kilogram-6347.customers.stytch.com/.well-known/oauth-authorization-server — HTTP 200; registration_endpoint: https://rustic-kilogram-6347.customers.stytch.com/v1/oauth2/register",
      "observedAt": "2026-11-12T02:19:33Z"
    },
    {
      "feature": "mcp.as.iss-param",
      "name": "Issuer identifier in authorization responses",
      "party": "authorization-server",
      "level": "SHOULD",
      "section": "Authorization › Authorization Response Validation",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "supported",
      "evidence": "https://rustic-kilogram-6347.customers.stytch.com/.well-known/oauth-authorization-server — HTTP 200; authorization_response_iss_parameter_supported: true",
      "observedAt": "2026-11-12T02:19:33Z"
    },
    {
      "feature": "mcp.as.pkce-s256",
      "name": "PKCE with S256 advertised",
      "party": "authorization-server",
      "level": "MUST",
      "section": "Security Considerations › Authorization Code Protection",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "supported",
      "evidence": "https://rustic-kilogram-6347.customers.stytch.com/.well-known/oauth-authorization-server — HTTP 200; code_challenge_methods_supported: [S256]",
      "observedAt": "2026-11-12T02:19:33Z"
    },
    {
      "feature": "mcp.as.https",
      "name": "All endpoints served over HTTPS",
      "party": "authorization-server",
      "level": "MUST",
      "section": "Security Considerations › Communication Security",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "supported",
      "evidence": "https://rustic-kilogram-6347.customers.stytch.com/.well-known/oauth-authorization-server — HTTP 200; all 5 endpoints use https",
      "observedAt": "2026-11-12T02:19:33Z"
    }
  ],
  "summary": {
    "state": "scanned",
    "label": "MUST 8 supported · SHOULD 3 supported, 1 unsupported · MAY 2 supported",
    "tallies": [
      {
        "level": "MUST",
        "total": 8,
        "counts": [
          {
            "status": "supported",
            "n": 8
          }
        ]
      },
      {
        "level": "SHOULD",
        "total": 4,
        "counts": [
          {
            "status": "supported",
            "n": 3
          },
          {
            "status": "unsupported",
            "n": 1
          }
        ]
      },
      {
        "level": "MAY",
        "total": 2,
        "counts": [
          {
            "status": "supported",
            "n": 2
          }
        ]
      }
    ],
    "open": [
      {
        "feature": "mcp.rs.scope-challenge",
        "name": "Scope in the WWW-Authenticate challenge",
        "level": "SHOULD",
        "status": "unsupported"
      }
    ],
    "notes": []
  },
  "observations": []
}