Descope MCP authentication: known deviations
Path-nested issuer and scopes that only become discoverable after first use.
How Descope deviates from the MCP authorization spec
- The issuer nests the project id inside the URL path, and the JWKS lives at a different path shape than OIDC discovery implies.
- scopes_supported can be absent on the first metadata fetch and present on the second — scopes are discovered at runtime.
How to spot it without credentials
The Protected Resource Metadata's Cache-Control flips from no-store to public, max-age=3600 once scopes have been discovered.
What it breaks in production
A single-shot scan records a false “no scopes advertised”; only a scanner that re-reads the metadata sees the real configuration.
Check a Descope-backed MCP server
The free scanner runs the discovery and client-compatibility checks with no credentials, and every finding cites the spec requirement it violates:
npx mcpcomp https://your-mcp-server.example/mcp