MCP conformance testing for the authorization layer
The official MCP conformance suite deliberately ships no server-side authorization scenarios — its own requirements file says so. MCPComp fills exactly that gap, using the suite's own spec-reference identifiers so findings are comparable across tools.
npx mcpcomp https://mcp.example.com/mcp --jsonMachine-readable findings with official spec-reference identifiers — comparable with conformance results, diffable in CI.
What the official suite covers, and what it doesn't
The conformance project tests clients and authorization servers, and its server suite has no auth scenarios — the gap is documented as deliberate. Meanwhile the authorization spec keeps moving: the 2026-07-28 revision split it into four documents, deprecated Dynamic Client Registration in favour of Client ID Metadata Documents, and made RFC 9207 issuer validation mandatory. Whether your deployed server still conforms is a question nobody's suite answers.
How MCPComp covers it
A strict superset of the passive scenario
Every check in the conformance suite's passive authorization-server-metadata scenario is implemented, plus checks the suite grades but the SDK schema does not enforce — response types, issuer URL shape, bearer-method hygiene, content types — each citing the underlying RFC clause.
The active scenario, against real servers
mcpcomp verify --interactive drives the full authorization-code flow through the official SDK's own auth client, enforcing the same authorization-response requirements the conformance suite checks: state round-trip, RFC 9207 iss match, and the token-response contract.
Protocol-revision acceptance
The probe reports which protocol revisions the server accepts, so you know before a client ships whether the next spec revision breaks your deployment.
Frequently asked questions
How does this relate to the official conformance suite?
Same requirement identifiers, different vantage point. The official suite exercises clients and authorization servers in a harness; MCPComp probes your deployed production server from the outside, continuously.
Which spec revisions are covered?
The checks track the current authorization spec including the 2026-07-28 revision — CIMD, RFC 9207 issuer validation, issuer-bound credentials — and the probe reports which revisions a server accepts.
Verified against how many servers?
The entire official MCP registry: 11,496 remote servers. Of the 4,831 implementing MCP OAuth, about 10% fail with a requirement violation.