RFC 9728 Protected Resource Metadata is served and valid

How to fix this

Serve OAuth 2.0 Protected Resource Metadata (RFC 9728), normally at `/.well-known/oauth-protected-resource`. It is the document the 401 challenge points at.

How the validator checks this

Probe P8.2, against a streamable-http server on the modern protocol. What it reports:

pass

Protected Resource Metadata served and parsed

fail

Protected Resource Metadata not served or not valid JSON at … (HTTP …). MCP servers MUST implement RFC 9728.

Quoted from the probe that runs this check, so it cannot drift from what the validator actually reports.

This rule is checked deterministically: a fail here is a certain violation, not an inference.

Checked in the same request as MCP-AUT-003, MCP-AUT-009.

Check your own server against this rule

The validator makes real protocol requests and reports this rule as pass, warn or fail alongside the other 78. Validate a server or read how the check works.

Other Authorization rules

• MCP-AUT-001Unauthenticated request returns 401 with WWW-Authenticate resource_metadata
• MCP-AUT-003PRM resource equals the canonical server URI
• MCP-AUT-004Each listed authorization server exposes RFC 8414 or OIDC discovery metadata
• MCP-AUT-005AS advertises authorization_response_iss_parameter_supported: true
• MCP-AUT-006WWW-Authenticate includes a scope parameter
• MCP-AUT-007Insufficient scope returns 403 with error="insufficient_scope"
• MCP-AUT-008Tokens with a foreign audience are rejected
• MCP-AUT-009offline_access absent from scopes_supported / challenge scope
• MCP-AUT-010AS advertises S256 in code_challenge_methods_supported
• MCP-AUT-011AS supports Client ID Metadata Documents, not DCR alone