Discord MCP authentication: known deviations
Token metadata comes from @me instead of introspection, with scopes as a JSON array and identity in application.id.
How Discord deviates from the MCP authorization spec
- No introspection — the /@me endpoint substitutes for it.
- Token expiry is an ISO-8601 string, identity arrives as `application.id` rather than `aud`, and scopes are a JSON array instead of a space-delimited string.
How to spot it without credentials
Authorize at discord.com/oauth2/authorize.
What it breaks in production
A parser that treats `scope` as a space-delimited string reads it as empty, and standard audience checks have nothing to compare.
Check a Discord-backed MCP server
The free scanner runs the discovery and client-compatibility checks with no credentials, and every finding cites the spec requirement it violates:
npx mcpcomp https://your-mcp-server.example/mcp