Scan report

PayPal

https://mcp.paypal.com/sse against MCP Authorization 2026-07-28

Not scanned

No passive scan recorded yet for this server. The nightly run adds one when it can read the server's metadata; until then the atlas page shows what documentation says.

MCP server requirements
Requirement	Level	Status	Evidence	Observed
Protected Resource Metadata served `mcp.prm` · Authorization Server Discovery › Authorization Server Location	MUST	Unknown	no scanner observation	–
PRM lists an authorization server `mcp.prm.authorization-servers` · Authorization Server Discovery › Authorization Server Location	MUST	Unknown	no scanner observation	–
PRM lists scopes_supported `mcp.prm.scopes-supported` · Authorization › Scope Selection Strategy	MAY	Unknown	no scanner observation	–
PRM reachable at a well-known URI `mcp.prm.well-known` · Authorization Server Discovery › Protected Resource Metadata Discovery Requirements	MUST	Unknown	no scanner observation	–
No offline_access in advertised scopes `mcp.prm.no-offline-access` · Authorization › Refresh Tokens	SHOULD	Unknown	no scanner observation	–

Authorization server requirements
Requirement	Level	Status	Evidence	Observed
Metadata issuer matches the discovery URL `mcp.as.issuer-match` · Authorization Server Discovery › Authorization Server Metadata Discovery	MUST	Unknown	no scanner observation	–
Authorization server metadata discoverable `mcp.as.metadata` · Authorization Server Discovery › Authorization Server Metadata Discovery	MUST	Unknown	no scanner observation	–
Client ID Metadata Documents supported `mcp.as.cimd` · Client Registration › Client ID Metadata Documents	SHOULD	Unknown	no scanner observation	–
Dynamic Client Registration offered `mcp.as.dcr` · Client Registration › Dynamic Client Registration	MAY	Unknown	no scanner observation	–
Issuer identifier in authorization responses `mcp.as.iss-param` · Authorization › Authorization Response Validation	SHOULD	Unknown	no scanner observation	–
PKCE with S256 advertised `mcp.as.pkce-s256` · Security Considerations › Authorization Code Protection	MUST	Unknown	no scanner observation	–
All endpoints served over HTTPS `mcp.as.https` · Security Considerations › Communication Security	MUST	Unknown	no scanner observation	–

Judged against MCP Authorization 2026-07-28 · method passive scan · letsauth-scanner/0.1.0

How the grade is derived

F when a MUST-level check is unsupported or partial.
Withheld (no letter) when a MUST-level check is unknown: the scanner could not establish it.
C when every MUST-level check is supported and a SHOULD-level check is unsupported or partial.
B when every MUST-level check is supported, no SHOULD-level check fails, and a SHOULD-level check is unknown.
A when every MUST-level and SHOULD-level check is supported.
MAY-level and deprecated requirements are listed and never change the grade.

Derived from the statuses above at build time; never used to sort or rank servers. About the scanner.

Not checked by the scanner

These requirements need a request to the endpoint or a reading of the implementation. Their cells on the atlas page come from documentation and manual checks.

resource_metadata in the 401 challengeactive
Documented pre-registration pathmanual
403 insufficient_scope for step-upactive
Scope in the WWW-Authenticate challengeactive
Refresh token rotation for public clientsmanual
Resource indicators honouredmanual
401 for missing or invalid tokensactive
Audience validationactive
Bearer token only in the Authorization headeractive
No token passthrough to upstream APIsmanual
Per-client consent on proxy serversmanual

Reproduce this report: pnpm scan paypal in the repository. Corrections are new observations, never edits; see docs/scanner.md.