MCP endpoint requires auth but has no discoverable OAuth metadata
MCP-AUTH-001 · v1.0
What it detects
This site's MCP server signaled that authentication is required, but an unauthenticated read of its RFC 9728 OAuth protected-resource metadata document did not return a usable authorization_servers list.
Why it matters
An agent that hits the auth challenge has no standard, machine-readable way to learn where to obtain a token — only the public discovery document is read here, no auth flow or credentials are ever attempted.
How to fix
- Publish an RFC 9728 OAuth protected-resource metadata document at `/.well-known/oauth-protected-resource` for the MCP endpoint's origin. - The document must include an `authorization_servers` array listing at least one authorization server so agents can discover where to authenticate. - Verify: `curl {origin}/.well-known/oauth-protected-resource` returns 200 with valid JSON and a non-empty `authorization_servers` array.
References
Last reviewed: 2026-09-01 · rule v1.0