Best fit
MCP server and client teams debug 401 challenges, protected-resource metadata, issuer discovery, resource indicators, PKCE, scopes, and token audience from ad hoc traces.
// AI Agents & LLM Ops
MCP OAuth & Authorization Contract Preflight
Preflight redacted MCP 2026-07-28 OAuth evidence for issuer discovery, registration, PKCE, scopes, token audience, refresh behavior, and role-specific gaps.
What problem does MCP OAuth & Authorization Contract Preflight solve?
MCP client, server, gateway, and platform teams need to catch authorization-contract regressions before a migration reaches production. This offline gate turns owner-supplied, redacted metadata, registration records, and transcripts into deterministic findings for the stable MCP 2026-07-28 profile.
Use it to
- Preflight an MCP 2026-07-28 authorization migration before release
- Check exact issuer discovery, DCR application type, registration binding, PKCE, resources, scopes, and token audience
- Separate blocking defects, review findings, and incomplete-evidence CANNOT_ASSESS results
What it returns
- findings.csv with stable codes and evidence sources
- review-manifest.csv with every reviewed record
- result.json with READY, REVIEW, CANNOT_ASSESS, or BLOCK gate and SHA-256 receipt
- report.md with a human-review handoff
A representative input and result
input Pin `rule_snapshot` to `MCP-2026-07-28`, `spec_status` to `stable`, and the documented official source digests. Supply role-appropriate metadata documents, registrations, and redacted transcripts with opaque evidence references.
result A deterministic READY, REVIEW, CANNOT_ASSESS, or BLOCK result with stable finding codes, a complete review manifest, a human-readable report, and a SHA-256 receipt.
Access and approval boundaries
- Terminal permission to run the bundled local Python reconciler.
- Read access to one user-selected normalized UTF-8 JSON packet.
- Write access only to one user-selected local output directory.
- No browser, network, credential, account, environment-variable, messaging, payment, deletion, access-change, filing, or publication permission.
Known limitations
- The pinned MCP-2026-07-28 rule snapshot can become stale and must be reviewed against later MCP revisions.
- The package does not send OAuth requests, handle tokens, or prove server interoperability.
- READY is not authorization to deploy or a security certification.
// choose with context
Is MCP OAuth & Authorization Contract Preflight the right skill?
It returns
findings.csv with stable codes and evidence sources. review-manifest.csv with every reviewed record.
Do not use it as
The pinned MCP-2026-07-28 rule snapshot can become stale and must be reviewed against later MCP revisions.
Compatibility, access, version, and licence
- Reads or accesses
- Declared local scope: one owner-selected local JSON input, one owner-selected local output directory.
- Compatibility
- SKILL.md-compatible agents that can run a local Python helper. Python 3.10 or newer on Windows, macOS, or Linux using only the standard library. One documented UTF-8 JSON evidence packet; no API key or provider account.
- Version
- 1.1.0
- Licence
- Review the package licence and seller terms at the linked destination.
Questions
Does it connect to a live account or provider?
No. It reads one normalized local JSON packet and makes no network request.
Does it make the final decision or external change?
No. It produces evidence findings; the responsible owner makes every decision and action outside the package.
Is the result deterministic?
Yes. Stable finding codes, sorted records, and a SHA-256 receipt make repeated review inspectable.
When does it return CANNOT_ASSESS?
It returns CANNOT_ASSESS when the supplied packet lacks evidence required for the declared client, server, or combined implementation role.
What happens with malformed input?
Unreadable JSON, missing arrays, duplicate core identifiers, invalid timestamps, and invalid core numbers fail closed.
Does READY prove the underlying evidence is true?
No. READY means no automated finding appeared in the supplied normalized packet; source truth still requires human review.
Preflight the MCP authorization contract before deployment.
Version 1.1.0 includes the tested offline package, realistic fixtures, declared permissions, explicit evidence gaps, and a checksum-pinned buyer receipt.
Get MCP OAuth & Authorization Contract Preflight v1.1