RFC 9728 Protected Resource Metadata is served and valid

How to fix this

Serve OAuth 2.0 Protected Resource Metadata (RFC 9728), normally at `/.well-known/oauth-protected-resource`. It is the document the 401 challenge points at.

Example: failing and passing

GET /.well-known/oauth-protected-resource HTTP/1.1
Host: mcp.example.com
Accept: application/json

HTTP/1.1 404 Not Found

GET /.well-known/oauth-protected-resource HTTP/1.1
Host: mcp.example.com
Accept: application/json

HTTP/1.1 200 OK
Content-Type: application/json

{
  "resource": "https://mcp.example.com/mcp",
  "authorization_servers": ["https://auth.example.com"],
  "scopes_supported": ["files:read"]
}

How the validator checks this

Probe P8.2, against a streamable-http server on the modern protocol. What it reports:

pass

Protected Resource Metadata served and parsed

fail

Protected Resource Metadata not served or not valid JSON at … (HTTP …). MCP servers MUST implement RFC 9728.

Quoted from the probe that runs this check, so it cannot drift from what the validator actually reports.

This rule is checked deterministically: a fail here is a certain violation, not an inference.

Checked in the same request as MCP-AUT-003, MCP-AUT-009.

Check your own server against MCP-AUT-002

Probe P8.2 checks MCP-AUT-002 in the same request as 2 other rules, so one run shows your server's result for this rule next to the rest. Validate a server or read how the validator works.

Background on this topic: how to add OAuth to an MCP server.

Other Authorization rules

• MCP-AUT-001Unauthenticated request returns 401 with WWW-Authenticate resource_metadata
• MCP-AUT-003PRM resource equals the canonical server URI
• MCP-AUT-004Each listed authorization server exposes RFC 8414 or OIDC discovery metadata
• MCP-AUT-005AS advertises authorization_response_iss_parameter_supported: true
• MCP-AUT-006WWW-Authenticate includes a scope parameter
• MCP-AUT-007Insufficient scope returns 403 with error="insufficient_scope"
• MCP-AUT-008Tokens with a foreign audience are rejected
• MCP-AUT-009offline_access absent from scopes_supported / challenge scope
• MCP-AUT-010AS advertises S256 in code_challenge_methods_supported
• MCP-AUT-011AS supports Client ID Metadata Documents, not DCR alone