Review OAuth authorization-server metadata used by an MCP deployment for issuer, endpoint, PKCE and Client ID Metadata Document settings.
MCP 2026-07-28 strengthens OAuth integration with issuer validation and Client ID Metadata Documents. This tool performs static metadata checks only; it never contacts an authorization server.
Validate OAuth authorization server metadata used by MCP including issuer, endpoints, PKCE and CIMD support.
Use MCP OAuth Metadata Validator as a focused pre-flight utility while building, reviewing or debugging an MCP integration. Paste the relevant configuration, protocol message, metadata, schema or value into the tool and review the returned findings before the same data reaches a production client or server.
Authorization metadata must be treated as security-sensitive configuration. Static validation can reveal obvious inconsistencies, but a production OAuth deployment must also validate live issuer, redirect, token and authorization behavior at runtime.
A clean result means the input passed the rules implemented by this utility. It does not guarantee application security, protocol interoperability or correct business behavior. Test important integrations against the exact MCP client, SDK, gateway and server versions used in your deployment.
MCP Protected Resource Metadata Validator