We Checked 61 Official MCP Servers Against the Auth Spec
Most SaaS companies now ship an official remote MCP server, and most of them sit behind OAuth. We wanted to know how closely those servers follow the current MCP authorization spec (the 2026-07-28 revision), so we checked the official servers of 67 vendors from the outside. 61 of them require a login. This post is about those 61. The short version: the basics are done everywhere. The newer parts…
A recent check of 61 official MCP servers against the authorization specification revealed that most servers follow the basics of the spec, but fall short on newer requirements. All 61 servers required authentication and advertised PKCE with S256. Additionally, 56 servers published OAuth Protected Resource Metadata and 25 advertised Client ID Metadata Documents, while the remaining 36 relied on dynamic registration or manual setup.
However, 40 servers did not advertise the iss parameter in authorization responses, which could help prevent OAuth mix-up attacks. Scope hint was provided by 22 servers, but most clients would still need to guess the appropriate scopes. Six servers updated their specifications between October 26 and November 4, including Apollo, Cal.com, Neon, and Datadog. The checker tool used for this evaluation is available at https://x1y1.co/api/mcp-check?url=server.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
