MCP OAuth Protected Resource Metadata, PKCE & Authorization Compatibility Preflight

MCP OAuth Protected Resource Metadata, PKCE & Authorization Compatibility Preflight

Validate MCP protected-resource and OAuth authorization-server metadata; diagnose PKCE and client compatibility; and predict interoperability failures before connecting, without accepting credentials.

0.03 USDC per successful call · Base or Solana · x402

Paid endpoint: https://auth.inversolabs.us/v1/services/mcp-auth-preflight/invoke

Why buy instead of recreate?

Foundry estimates that reproducing and testing this maintained capability would cost an agent about $12.0 and 240 minutes, versus 0.03 USDC per successful call. This is a Foundry estimate, not measured customer behavior.

Free Agent Skill · Download Skill ZIP

Example invocation

POST https://auth.inversolabs.us/v1/services/mcp-auth-preflight/invoke
Idempotency-Key: your-stable-request-id
Content-Type: application/json

{
  "authorization_server_metadata": {
    "authorization_endpoint": "https://auth.example.com/authorize",
    "code_challenge_methods_supported": [
      "S256"
    ],
    "issuer": "https://auth.example.com",
    "registration_endpoint": "https://auth.example.com/register",
    "token_endpoint": "https://auth.example.com/token"
  },
  "client": {
    "supports_dcr": true,
    "supports_protected_resource_metadata": true,
    "supports_resource_parameter": true
  },
  "protected_resource_metadata": {
    "authorization_servers": [
      "https://auth.example.com"
    ],
    "resource": "https://mcp.example.com/mcp"
  },
  "resource_url": "https://mcp.example.com/mcp"
}

Illustrative successful result

{
  "checks": [
    {
      "name": "protected_resource_matches",
      "passed": true
    },
    {
      "name": "authorization_servers",
      "passed": true
    },
    {
      "name": "issuer_https",
      "passed": true
    },
    {
      "name": "authorization_endpoint",
      "passed": true
    },
    {
      "name": "token_endpoint",
      "passed": true
    },
    {
      "name": "pkce_s256",
      "passed": true
    },
    {
      "name": "resource_indicators",
      "passed": true
    },
    {
      "name": "protected_resource_discovery",
      "passed": true
    },
    {
      "name": "registration_path",
      "passed": true
    }
  ],
  "compatible": true,
  "failures": [],
  "remediation": [],
  "ruleset_version": "2026-08-25.1",
  "spec_version": "2025-11-25",
  "status": "completed",
  "token_handling": "tokens_not_accepted_or_retained",
  "verdict": "compatible",
  "warnings": []
}