MCP authentication breaks quietly. Catch it first.
MCPComp scans, grades, and monitors the OAuth layer of MCP servers. Every finding cites the spec requirement it violates — no opinions, no noise.
Verified against the entire official MCP registry.
11,496 remote servers scanned. About 10% of OAuth implementations fail.
Three questions, answered from outside
MCPComp does not replace Auth0, Entra, Okta or WorkOS. It sits above them and checks that the whole setup still works — the spec has shipped four revisions in eighteen months, identity providers disagree on the primitives, and clients diverge. Read the research
Is our MCP authentication working right now?
Will anything break soon?
If something is wrong, what changed?
Diagnose without leaving the conversation
The scanner is itself an MCP server. Add mcpcomp serve to any client, and an agent whose MCP connection is failing can run the diagnosis itself — read-only, no credentials.
Support triage in one command
mcpcomp doctor answers the first support question — whose layer is it — from the outside, with no credentials.
Why this layer was blamed
Every layer visible without credentials checks out — a fully green server plus a failing client is itself the diagnosis
Alternatives
scan_auth and diagnose_auth_failure
Two read-only tools, exposed over stdio. Connect them to Claude Code, Cursor, ChatGPT, and more.
// mcpcomp serve (stdio)
"mcpServers": {
"mcpcomp": {
"command": "npx"
Catch drift before it pages you
A diff engine over the metadata documents. The same probes on a schedule, compared against a committed baseline — a field disappears, an issuer changes, a secret nears expiry, and you know first.
Grades a reader can check
The letter counts requirement violations only — recommendations a server skips are advisories, and never decide the grade.
Scan report
Baseline drift
Baselines live in the repository, so drift arrives as a reviewable diff — no scheduler, no database.
No drift since the committed baseline
Daily, via cronEvery finding cites
the requirement it enforces
Advisories do not affect the grade. Authorization-response issRFC 9207 binding is not advertised — enable it and publish authorization_response_iss_parameter_supported: true.
PRM reachable, issuer identity, the full discovery ladder.
PKCE S256, DCR or CIMD, RFC 9207, protocol revisions.
HTTPS everywhere, scope minimization, offline_access absent.
The one failure metadata cannot show — read from inside Entra.
One binary,
every layer
Scan, diagnose, verify, monitor, and rotate — the CLI covers the whole authentication path, from discovery metadata to the credential that expires inside your identity provider.
Your MCP doesn't connect since this morning...
mcpcomp <url>
Grade a server's OAuth layer in one command
mcpcomp doctor
Classify whose layer broke — server, AS, or client
mcpcomp verify
Prove the M2M token path end to end
mcpcomp entra --rotate
Rotate expiring secrets with zero downtime
mcpcomp serve
Run the scanner as an MCP server for agents
--baseline
Diff scans and alert when configuration drifts
--json
Machine-readable reports with honest exit codes