MCP Authorization Flow Compliance Tester

Skip Client Registration Tests

Bypass client registration

Skip OAuth Flow Tests

Bypass OAuth 2.1 authorization flow, PKCE, and token validation tests

Interactive OAuth Flow

Enable browser-based user authentication with PKCE (S256 for MCP 2025-11-25)

OAuth Callback Port Port for OAuth callback server (default: 3000)

Resource Parameter (RFC 8707) Resource server URL (REQUIRED for MCP 2025-11-25). Used in authorization/token requests and validated in JWT aud claim.

Privileged Tool Name (Optional - for Step-Up Auth Test) Optional: Tool requiring elevated scope for testing scope challenge handling (test step-1.5). Tool should return 403 with scope challenge when accessed with base token.

Use Pre-Configured Client (Preregistration)

Priority #1: Use existing client credentials (bypasses Client ID Metadata and DCR)

Client ID *

Client Secret

OAuth Scopes Space-separated list of scopes (default: "openid profile email")

Redirect URI Full redirect URI registered with your IDP (e.g., http://localhost:8082/)

Client ID Metadata Document (MCP 2025-11-25)

Priority #2: Use HTTPS URL as client_id (falls back to DCR if unavailable)

Client ID Metadata URL * HTTPS URL that resolves to a JSON metadata document containing client_id, redirect_uris, etc.

Allow HTTP MCP Connection

Enable authenticated HTTP connections to non-localhost MCP servers (localhost always allowed - HTTPS recommended for production)

Enable Debug Mode

Capture and display request/response data for debugging

🔐 MCP Authorization Flow Compliance Tester

Options