{"criteria_id":"mcp-auth-surface/v1","target_revision":"2026-07-28","prior_revision":"2025-11-25","price":{"label":"$0.05","units":50000,"status":"RULED","basis":"per report"},"blocks":{"A":"this report grades the endpoint's published auth surface against the specification's discovery and challenge requirements. It does not test token validation, session handling, or any behaviour behind authentication, and it is not a security certification.","B":"A declaration that conforms to the specification proves only that the declaration conforms. It does not prove that the server does what the declaration declares: a conforming metadata document, challenge, or scope list is not evidence that tokens are validated, that audiences are enforced, that sessions are bound to the authenticated principal, or that any other declared behaviour is performed in operation."},"declared_label":"DECLARED BY THE OPERATOR AND NOT VERIFIED BY THE SERVICE.","payment_includes":"$0.05 per report — RULED. The payment includes: the signed full report — every class-(i) check graded, every class-(ii) check graded or recorded not-observed, the coverage block, the evidence manifest — and nothing on the disclosure list.","disclosure_intro":"What this report cannot assess — read before paying. This report grades the endpoint's published auth surface only: the metadata documents and the unauthenticated challenge, as listed in the criteria. The following are NOT ASSESSABLE by this service, are not tested, and no grade in the report says anything — favourable or unfavourable — about any of them:","disclosure":["1. Token validation. Whether the server accepts or rejects any token presented to it — expired, malformed, wrongly signed, or issued by another authorization server. No token is ever presented under this service's contract.","2. Audience enforcement. Whether the server rejects a token that was not issued for itself (the RFC 8707 `resource` discipline in operation), and whether token passthrough occurs. The report grades that the declaration names the resource; it does not grade that the resource is enforced.","3. Session binding and session handling. Whether sessions are bound to the authenticated principal, and any other session behaviour.","4. Anything behind authentication. Without limitation: whether requests are in fact authenticated and authorized as the surface declares; whether authenticated-only material is exposed to unauthenticated callers; whether objects belonging to one tenant can be read, changed, or cancelled by another (ownership / IDOR-class checks); and whether outbound destinations registered with the server (for example push-notification webhooks) are validated (SSRF-class checks). Detecting any of them would require presenting credentials or forged artefacts to the server — which this service does not do, under any rung, at any price.","5. The identity of the operator. Who operates the endpoint in the world; whether the endpoint is operated by the party its surface names; whether a server name is the named party's to use; and who holds any key. This fleet proves key-possession and standing where it proves anything; it never proves identity, and this report does not grade keys at all. Declared identity in the report is labelled, wherever it appears: \"DECLARED BY THE OPERATOR AND NOT VERIFIED BY THE SERVICE.\"","6. Advertised-mechanism enforcement, in general. For every mechanism the surface advertises — including PKCE, whose S256 advertisement the report does grade — the report grades the advertisement, never the enforcement.","7. Competence, lawfulness, and safety — and security in general. Whether the operator is competent or lawful; whether the server is safe to delegate to, send data to, or rely on; and, in the words of the report's own scope line, this report is not a security certification of any kind.","8. Scope enforcement in operation. Whether a token with insufficient scope is in fact refused (including any step-up challenge), and whether broader scopes are in fact treated as implying narrower ones.","9. Advertised mechanisms in operation, named. Whether, in operation: authorization responses actually carry the `iss` parameter and any client validates it; tokens are actually issued bound to the requested resource; redirect URIs are actually validated exactly; refresh tokens are actually rotated and stored as the specification requires; consent is actually obtained, from the right user, for the scopes actually granted; the authorization server actually fetches and validates Client ID Metadata Documents (and does so safely); a declared registration endpoint actually registers clients; and declared revocation and introspection endpoints actually revoke or introspect. Item 6 states the general rule; this item names its members (Lane 1's class-(iii) inventory III-05…III-15, III-21).","10. TLS in practice. Certificate validity, TLS version and cipher posture, and HSTS at the live endpoints. The report grades that declared endpoint URLs use the `https` scheme; no handshake is observed in the documents form.","11. Key material behind declared URIs, and freshness. Whether the key sets behind declared `jwks_uri` values are valid, current, and uncompromised; whether signed metadata verifies against a key there is independent reason to trust; whether the documents graded are still the documents served at any later time; and the availability or performance of the declared surface. None of these is assessed.","12. Credential storage in practice. Whether client credentials are in fact stored keyed by their issuing authorization server and never reused across authorization servers. This is a client-side property no submitted document evidences."],"disclosure_closing":"If what you need is any item on this list, do not pay for this report — it will not contain it, and no other rung of this service contains it either.","transition_labels":["TRANSITION-2025-11-25/DCR-NOT-YET-DEPRECATED","TRANSITION-2025-11-25/ISS-VALIDATION-NOT-YET-SPECIFIED","TRANSITION-2025-11-25/CREDENTIAL-KEYING-NOT-YET-REQUIRED","TRANSITION-2025-11-25/SCOPE-CHALLENGE-FLEXIBLE","TRANSITION-2025-11-25/STANDARDS-SET-PRE-9207-6750"],"check_ids":["I-P01","I-P02","I-P03","I-P04","I-P05","I-P06","I-P07","I-P08","I-A01","I-A02","I-A03","I-A04","I-A05","I-A06","I-A07","I-A08","I-A09","I-A10","I-A11","I-A12","I-A13","I-C01","I-C02","I-C03","I-C04","X-03","X-04","X-05","X-06","X-07","II-01","II-02","II-03","II-04","II-05","II-06","II-07","II-08"],"caps":{"max_doc_bytes":65536,"max_fetch_bytes":65536,"max_capture_bytes":16384},"constructions_note":"X-01/X-02 are ungraded construction records.","corpus":{"id":"mcp-auth-surface-corpus/v1","sha256":"c49f88f78635226ede5ee7e89171f45473bf2e293741976f15ecde35b696d1fd"},"kill_line":"Kill line (M-47 / A3, from the deepening pass §9): Day-0 = the first OUTSIDE paid settle (house payments never count). Day-0 + 60 days: report-only checkpoint. Keep/park decision at Day-0 + 6 months. Tripwires: refunds >5% of paid reports in any 30 days — stop serving; free use >10x paid use — stop serving; a wrong verdict from undisclosed stale or partial data — stop serving; a conformance report presented as proof a server is secure or an operator verified — stop-and-review; a version verdict presented as proof a server is incompatible or unsafe — stop-and-review."}