More screenshots

    Works with the AI tools you already use

    CClaude CodeCCursorCCodex CLIGGitHub CopilotGGemini CLI+17 more

    🔐 MCP OAuth & Authorization Contract Preflight

    by JustHandled Labs

    2

    Preflight redacted MCP 2026-07-28 OAuth evidence for issuer discovery, registration, PKCE, scopes, token audience, refresh behavior, and role-specific gaps.

    Secure checkout via Stripe

    0 installsSecurity scanned

    See it in action

    You say

    Set rule_snapshot to MCP-2026-07-28 and spec_status to stable; supply the pinned official source digests, declared implementation_role, metadata documents, registrations, redacted transcripts, and non-empty evidence references.

    Your agent does

    A deterministic READY, REVIEW, BLOCK, or CANNOT_ASSESS result with stable finding codes, a complete review manifest, a human-readable report, and a SHA-256 receipt.

    What you get

    Preflight an MCP 401 discovery exchangeCheck PKCE and resource-indicator evidenceBlock token passthrough and wrong-audience acceptance evidence

    About this skill

    MCP OAuth & Authorization Contract Preflight turns owner-supplied, redacted OAuth evidence into a deterministic local migration gate for the stable MCP 2026-07-28 profile. It checks protected-resource and authorization-server metadata alignment, exact issuer discovery, DCR application_type and issuer-bound registration, PKCE, resource indicators, token audience, step-up scope union, refresh guidance, evidence references, and declared client/server role coverage. The bundled Python helper writes stable findings, a complete review manifest, JSON and Markdown reports, and a SHA-256 receipt. It runs offline, handles no live token or credential, and returns CANNOT_ASSESS when role-relevant evidence is incomplete. READY does not prove interoperability, authorize deployment, or provide a security certification.

    Changelog

    1. v1.1LatestAug 4, 2026

      Updated to stable MCP 2026-07-28. Adds exact issuer and discovery validation, DCR application_type and issuer-bound registration checks, step-up scope-union and refresh guidance, role-specific client/server evaluation, evidence-reference enforcement, and CANNOT_ASSESS for incomplete evidence. Validated with 11 product tests plus focused runs against the official TypeScript SDK and MCP Inspector. Still offline, secret-free, and not a security certification.

    2. v1.0Aug 1, 2026

      Initial release

    How to install

    Drop the file into your AI Agent. Works with Claude, Cursor, ChatGPT, and 20+ more.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill passes our trust checks below.

    Security scanned

    Passed our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    30-day refund

    Not a fit? Get your money back

    Frequently Asked Questions

    Popular in AI Agents & LLM Ops