{
  "id": 18038241,
  "title": "We Checked 61 Official MCP Servers Against the Auth Spec",
  "url": "https://urgent.news/2026/11/03/we-checked-61-official-mcp-servers-against-the-auth-spec",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-03T23:35:04.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/x1y1co/we-checked-61-official-mcp-servers-against-the-auth-spec-48i4"
  },
  "original_language": "en",
  "account": "A recent check of 61 official MCP servers against the authorization specification revealed that most servers follow the basics of the spec, but fall short on newer requirements. All 61 servers required authentication and advertised PKCE with S256. Additionally, 56 servers published OAuth Protected Resource Metadata and 25 advertised Client ID Metadata Documents, while the remaining 36 relied on dynamic registration or manual setup. However, 40 servers did not advertise the iss parameter in authorization responses, which could help prevent OAuth mix-up attacks. Scope hint was provided by 22 servers, but most clients would still need to guess the appropriate scopes. Six servers updated their specifications between October 26 and November 4, including Apollo, Cal.com, Neon, and Datadog. The checker tool used for this evaluation is available at https://x1y1.co/api/mcp-check?url=server.",
  "summary": "Most SaaS companies now ship an official remote MCP server, and most of them sit behind OAuth. We wanted to know how closely those servers follow the current MCP authorization spec (the 2026-07-28 revision), so we checked the official servers of 67 vendors from the outside. 61 of them require a login. This post is about those 61. The short version: the basics are done everywhere. The newer parts…",
  "key_points": [
    "61 official MCP servers checked against authorization spec",
    "56 servers published OAuth Protected Resource Metadata",
    "40 servers lacked iss parameter in authorization responses"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}