MCP sign-in check failures

Rondar could not connect to the address, or the server did not answer in time. Each call has a time limit of a few seconds, and all steps together stop after 15 seconds.

Make sure that the address is public and that the server answers in a few seconds. A server that sleeps when it has no traffic can be too slow for the first call.

An address in the answers is not a public HTTPS address. Rondar does not call private, loopback, link-local or metadata addresses, and it does not call an http:// address.

Use public HTTPS addresses for the server, the protected resource metadata, the authorization server and each endpoint.

The server answered the initialize request with a redirect (3xx). Rondar does not follow a redirect, because the address after a redirect is not the address that the person gave.

Give the final address of the MCP endpoint. For example, give https://mcp.example.com/mcp and not https://example.com/mcp.

The server did not answer 401 to an initialize request with no token. A server that asks for an OAuth sign-in answers 401 with a WWW-Authenticate header.

Make sure that the address is the MCP endpoint, for example /mcp, and not the home page. Answer 401 when a request has no token, before the server reads the request.

The 401 answer has no WWW-Authenticate header with resource_metadata. This is a warning: Rondar then tries the well-known addresses of the server. Other clients can stop here.

Add the header to each 401 answer:

WWW-Authenticate: Bearer resource_metadata="https://mcp.example.com/.well-known/oauth-protected-resource"

Rondar found no protected resource metadata (RFC 9728) at the address of the header or at /.well-known/oauth-protected-resource. This is a warning: Rondar used the origin of the server as the authorization server, as the first MCP authorization specification did.

Serve the document with the resource and its authorization server:

{
  "resource": "https://mcp.example.com/mcp",
  "authorization_servers": ["https://auth.example.com"]
}

The resource in the protected resource metadata does not cover the address of the server. It must have the same scheme, host and port, and the path of the server must be the path of the resource or below it. A client must refuse a document for another resource.

Set resource to the address of the MCP endpoint.

Rondar found no authorization server metadata (RFC 8414) and no OpenID configuration for the issuer. For an issuer with no path, Rondar tries /.well-known/oauth-authorization-server and /.well-known/openid-configuration. For an issuer with a path, it puts the path after the well-known name, and it also tries the path followed by /.well-known/openid-configuration.

Serve the metadata at one of these addresses, with an answer of 200 and a JSON object.

The issuer in the metadata is not the address that authorization_servers names. A client must refuse such a document.

Make issuer the same address as the value in authorization_servers. A slash at the end does not count.

The metadata has no authorization_endpoint or no token_endpoint, or one of them is not an HTTPS address.

Publish both endpoints with HTTPS addresses.

code_challenge_methods_supported does not include S256. Rondar signs in with PKCE and S256 only, so it stops here.

Support PKCE with S256 and say so in the metadata:

"code_challenge_methods_supported": ["S256"]

The metadata has no HTTPS registration_endpoint. A headless agent has no client id of its own, so it cannot start a sign-in without dynamic client registration.

Support dynamic client registration (RFC 7591) and publish registration_endpoint.

The registration endpoint refused the request of the check. The request had the name "Rondar MCP check", one redirect address, the grant types authorization_code and refresh_token, and no initial access token. The report shows the HTTP status and, when the server gives one, the error code of RFC 7591, for example invalid_redirect_uri.

Accept open registration from a client with an HTTPS redirect address. If you accept only some redirect addresses, write which ones in your docs.

The registration endpoint accepted the request, but the answer has no client_id.

Answer with a JSON object that has client_id, as section 3.2.1 of RFC 7591 shows.

All steps together took more than 15 seconds, and this step did not end in time.

Make each endpoint answer in a few seconds.