// AI Agents & LLM Ops

MCP OAuth & Authorization Contract Preflight

Preflight redacted MCP 2026-07-28 OAuth evidence for issuer discovery, registration, PKCE, scopes, token audience, refresh behavior, and role-specific gaps.

Get v1.1 on Ko-fi Browse all skills $19 one-time

What problem does MCP OAuth & Authorization Contract Preflight solve?

MCP client, server, gateway, and platform teams need to catch authorization-contract regressions before a migration reaches production. This offline gate turns owner-supplied, redacted metadata, registration records, and transcripts into deterministic findings for the stable MCP 2026-07-28 profile.

Use it to

Preflight an MCP 2026-07-28 authorization migration before release
Check exact issuer discovery, DCR application type, registration binding, PKCE, resources, scopes, and token audience
Separate blocking defects, review findings, and incomplete-evidence CANNOT_ASSESS results

What it returns

findings.csv with stable codes and evidence sources
review-manifest.csv with every reviewed record
result.json with READY, REVIEW, CANNOT_ASSESS, or BLOCK gate and SHA-256 receipt
report.md with a human-review handoff

A representative input and result

fixture-backed sample

input Pin `rule_snapshot` to `MCP-2026-07-28`, `spec_status` to `stable`, and the documented official source digests. Supply role-appropriate metadata documents, registrations, and redacted transcripts with opaque evidence references.

result A deterministic READY, REVIEW, CANNOT_ASSESS, or BLOCK result with stable finding codes, a complete review manifest, a human-readable report, and a SHA-256 receipt.

Access and approval boundaries

Terminal permission to run the bundled local Python reconciler.
Read access to one user-selected normalized UTF-8 JSON packet.
Write access only to one user-selected local output directory.
No browser, network, credential, account, environment-variable, messaging, payment, deletion, access-change, filing, or publication permission.

Known limitations

The pinned MCP-2026-07-28 rule snapshot can become stale and must be reviewed against later MCP revisions.
The package does not send OAuth requests, handle tokens, or prove server interoperability.
READY is not authorization to deploy or a security certification.

Questions

Does it connect to a live account or provider?

No. It reads one normalized local JSON packet and makes no network request.

Does it make the final decision or external change?

No. It produces evidence findings; the responsible owner makes every decision and action outside the package.

Is the result deterministic?

Yes. Stable finding codes, sorted records, and a SHA-256 receipt make repeated review inspectable.

When does it return CANNOT_ASSESS?

It returns CANNOT_ASSESS when the supplied packet lacks evidence required for the declared client, server, or combined implementation role.

What happens with malformed input?

Unreadable JSON, missing arrays, duplicate core identifiers, invalid timestamps, and invalid core numbers fail closed.

Does READY prove the underlying evidence is true?

No. READY means no automated finding appeared in the supplied normalized packet; source truth still requires human review.

Preflight the MCP authorization contract before deployment.

Version 1.1.0 includes the tested offline package, realistic fixtures, declared permissions, explicit evidence gaps, and a checksum-pinned buyer receipt.

Get MCP OAuth & Authorization Contract Preflight v1.1