{
  "version": 1,
  "scanner": "letsauth-scanner/0.1.0",
  "generatedAt": "2026-10-14T20:48:58.511Z",
  "recorded": true,
  "target": {
    "url": "https://mcp.stripe.com/",
    "server": "stripe"
  },
  "revision": {
    "spec": "mcp-authorization",
    "revision": "2026-07-28"
  },
  "method": "passive-scan",
  "requests": [],
  "discovered": null,
  "checks": [
    {
      "feature": "mcp.prm",
      "name": "Protected Resource Metadata served",
      "party": "mcp-server",
      "level": "MUST",
      "section": "Authorization Server Discovery › Authorization Server Location",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "unknown",
      "evidence": ""
    },
    {
      "feature": "mcp.prm.authorization-servers",
      "name": "PRM lists an authorization server",
      "party": "mcp-server",
      "level": "MUST",
      "section": "Authorization Server Discovery › Authorization Server Location",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "unknown",
      "evidence": ""
    },
    {
      "feature": "mcp.prm.scopes-supported",
      "name": "PRM lists scopes_supported",
      "party": "mcp-server",
      "level": "MAY",
      "section": "Authorization › Scope Selection Strategy",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "unknown",
      "evidence": ""
    },
    {
      "feature": "mcp.prm.well-known",
      "name": "PRM reachable at a well-known URI",
      "party": "mcp-server",
      "level": "MUST",
      "levelNote": "One of two discovery mechanisms the server must offer.",
      "section": "Authorization Server Discovery › Protected Resource Metadata Discovery Requirements",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "unknown",
      "evidence": ""
    },
    {
      "feature": "mcp.prm.no-offline-access",
      "name": "No offline_access in advertised scopes",
      "party": "mcp-server",
      "level": "SHOULD",
      "section": "Authorization › Refresh Tokens",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "unknown",
      "evidence": ""
    },
    {
      "feature": "mcp.as.issuer-match",
      "name": "Metadata issuer matches the discovery URL",
      "party": "authorization-server",
      "level": "MUST",
      "section": "Authorization Server Discovery › Authorization Server Metadata Discovery",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "unknown",
      "evidence": ""
    },
    {
      "feature": "mcp.as.metadata",
      "name": "Authorization server metadata discoverable",
      "party": "authorization-server",
      "level": "MUST",
      "section": "Authorization Server Discovery › Authorization Server Metadata Discovery",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "unknown",
      "evidence": ""
    },
    {
      "feature": "mcp.as.cimd",
      "name": "Client ID Metadata Documents supported",
      "party": "authorization-server",
      "level": "SHOULD",
      "section": "Client Registration › Client ID Metadata Documents",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "unknown",
      "evidence": ""
    },
    {
      "feature": "mcp.as.dcr",
      "name": "Dynamic Client Registration offered",
      "party": "authorization-server",
      "level": "MAY",
      "levelNote": "Deprecated; retained for compatibility with clients that cannot use Client ID Metadata Documents.",
      "section": "Client Registration › Dynamic Client Registration",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "unknown",
      "evidence": ""
    },
    {
      "feature": "mcp.as.iss-param",
      "name": "Issuer identifier in authorization responses",
      "party": "authorization-server",
      "level": "SHOULD",
      "section": "Authorization › Authorization Response Validation",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "unknown",
      "evidence": ""
    },
    {
      "feature": "mcp.as.pkce-s256",
      "name": "PKCE with S256 advertised",
      "party": "authorization-server",
      "level": "MUST",
      "section": "Security Considerations › Authorization Code Protection",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "unknown",
      "evidence": ""
    },
    {
      "feature": "mcp.as.https",
      "name": "All endpoints served over HTTPS",
      "party": "authorization-server",
      "level": "MUST",
      "section": "Security Considerations › Communication Security",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "unknown",
      "evidence": ""
    }
  ],
  "grade": {
    "letter": null,
    "label": "Not scanned",
    "reasons": []
  },
  "observations": []
}