mcp-authprobe

Name: mcp-authprobe
Author: Enigmacker

by Enigmackerversion 0.8.0i★ –iRuns on your computer

Registry nameio.github.Enigmacker/mcp-authprobe

Install

Overview

Description from the maker (original English)

Active OAuth tests for remote MCP servers you own: tokens, PKCE, redirect_uri, audience, CSRF.

PopNx MCP’s three pillars

These three are never merged into one score: opinions, measurements and popularity are different things.

User voiceiNo reviews yetReviews open together with accounts in a later step
Our basic checksi1 of 1 passedChecked from public information; code not scanned yet
UsageiNot measured yet★ –

What you can do with it

We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.

Connection: Runs on your computer
Transport: stdio
Category: Other
You need to fill in: MCP_AUTHPROBE_SECRET

Install

Pick the AI app you use, then copy the settings.

Before you install

Basic checks: 1 of 1 passed
Runs on your computer with your user’s permissions (files, network, apps).
You fill in yourself: MCP_AUTHPROBE_SECRET_FILE, MCP_AUTHPROBE_SECRET, MCP_AUTHPROBE_CREDENTIALS_FILE, MCP_AUTHPROBE_ALLOW_PRIVATE, MCP_AUTHPROBE_LAB_ORIGINS, MCP_AUTHPROBE_TIMEOUT_MS

Values marked secret are keys to your account. Never share them or paste them into a chat.

You need

npmNode.js installed (for the npx command)

Which app do you use?

ClaudeClaude CodeCursorVS CodeChatGPT

Pick your app above. We remember it, so next time the button says “Install in …”.

Open Claude Desktop → Settings → Developer → Edit Config, and paste this into claude_desktop_config.json

{
  "mcpServers": {
    "authprobe": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-authprobe",
        "mcp"
      ],
      "env": {
        "MCP_AUTHPROBE_SECRET_FILE": "your-value",
        "MCP_AUTHPROBE_SECRET": "your-value",
        "MCP_AUTHPROBE_CREDENTIALS_FILE": "your-value",
        "MCP_AUTHPROBE_ALLOW_PRIVATE": "your-value",
        "MCP_AUTHPROBE_LAB_ORIGINS": "your-value",
        "MCP_AUTHPROBE_TIMEOUT_MS": "your-value"
      }
    }
  }
}

Run this in your terminal

claude mcp add authprobe --env MCP_AUTHPROBE_SECRET_FILE=your-value --env MCP_AUTHPROBE_SECRET=your-value --env MCP_AUTHPROBE_CREDENTIALS_FILE=your-value --env MCP_AUTHPROBE_ALLOW_PRIVATE=your-value --env MCP_AUTHPROBE_LAB_ORIGINS=your-value --env MCP_AUTHPROBE_TIMEOUT_MS=your-value -- npx -y mcp-authprobe mcp

Fill in the empty values before running it.

Open in Cursor

Or copy the settings yourself

Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json

{
  "mcpServers": {
    "authprobe": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-authprobe",
        "mcp"
      ],
      "env": {
        "MCP_AUTHPROBE_SECRET_FILE": "your-value",
        "MCP_AUTHPROBE_SECRET": "your-value",
        "MCP_AUTHPROBE_CREDENTIALS_FILE": "your-value",
        "MCP_AUTHPROBE_ALLOW_PRIVATE": "your-value",
        "MCP_AUTHPROBE_LAB_ORIGINS": "your-value",
        "MCP_AUTHPROBE_TIMEOUT_MS": "your-value"
      }
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

Open in VS Code

Or copy the settings yourself

Paste into .vscode/mcp.json in your project

{
  "servers": {
    "authprobe": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "mcp-authprobe",
        "mcp"
      ],
      "env": {
        "MCP_AUTHPROBE_SECRET_FILE": "your-value",
        "MCP_AUTHPROBE_SECRET": "your-value",
        "MCP_AUTHPROBE_CREDENTIALS_FILE": "your-value",
        "MCP_AUTHPROBE_ALLOW_PRIVATE": "your-value",
        "MCP_AUTHPROBE_LAB_ORIGINS": "your-value",
        "MCP_AUTHPROBE_TIMEOUT_MS": "your-value"
      }
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

This one runs on your computer, and ChatGPT can only connect to servers on the internet. Pick another app.

Your choice stays on this device in a cookie; no account needed.

Values you fill in

MCP_AUTHPROBE_SECRET_FILE env
Path to the ownership secret (create it with `mcp-authprobe ownership init `). Without a secret, only discovery runs.
MCP_AUTHPROBE_SECRET secret env
Ownership secret, if not read from MCP_AUTHPROBE_SECRET_FILE.
MCP_AUTHPROBE_CREDENTIALS_FILE env
Path to a test grant written by `mcp-authprobe login`, for the refresh token checks. It is consumed by a scan.
MCP_AUTHPROBE_ALLOW_PRIVATE env
Set to 1 to allow loopback and private targets (local labs only).
MCP_AUTHPROBE_LAB_ORIGINS env
Comma-separated lab origins exempt from the ownership proof, e.g. http://127.0.0.1:8080.
MCP_AUTHPROBE_TIMEOUT_MS env
Per-request timeout in milliseconds (default 10000).

These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.

What it can do

Runs on your computer; the tool list appears in your AI app after you install it.

Basic checksi

We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 6, 2026

✓ Pass
Maker matches the repo
The registry name was verified with the GitHub account Enigmacker, which owns the repo
… Not checked yet
Still maintained
We have not read this repo from GitHub yet
… Not checked yet
Has a licence
We have not read this repo from GitHub yet
– Not applicable
Endpoint responds
This one runs on your computer; there is no internet endpoint
– Not applicable
Sign-in with OAuth
Runs on your computer and uses local settings instead
… Not checked yet
No hidden instructions in tool descriptions
Runs on your computer; we can only read tool lists from internet endpoints

Compared with others in Otheri

More stars than 0% of the other 32509 servers in this category
Published to the registry more recently than 94% of the other 32509 servers in this category
Basic checks equal to or better than 100% of the other 32509 servers in this category

Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.

Common questions

Is mcp-authprobe safe?

It passed 1 of 1 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.

What keys or codes does it need?

You need to fill in: MCP_AUTHPROBE_SECRET

Does it run on my computer or in the cloud?

It runs on your computer. Your AI app starts it when needed, and data does not pass through the maker’s servers (unless it calls an online service itself).

Is it still maintained?

The GitHub repo last changed –, and the latest version (0.8.0) reached the registry 2 days ago.

Which apps can use it?

Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. You also need Node.js on your computer.

What can I use instead?

In the same category: Spec Driven Development, Remote Desktop Commander, Fomu MCP

Alternatives

Servers in the same category from other makers, sorted by stars.

Reading a card:★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi

Spec Driven Development

by formulahendry

MCP Server that facilitates spec-driven development workflows, not just Vibe Coding.

Runs on your computer★ 440MITUpdated 14 months ago

Install

Remote Desktop Commander

by desktop-commander

Remote Desktop Commander: use files, terminal and processes on your own computers from any AI app.

Runs in the cloud★ 211Updated yesterday

Install

Fomu MCP

by gabrielmahia

Kenya government form guides: checklists, draft letters, eCitizen, Huduma, timelines. Sample data.

Runs on your computerUpdated today

Install

README from the maker

Open the README

Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.

mcp-authprobe

Active authorization testing for remote MCP servers you own.

Passive scanners read what a remote Model Context Protocol server *announces*: its OAuth metadata, its TLS setup, its tool descriptions. Some properties can only be confirmed by actually exercising the authorization server: does it really rotate refresh tokens, does it really refuse a redirect URI it never registered, does it enforce PKCE, does it accept a token meant for another server, does it slow down repeated failures?

mcp-authprobe runs those active checks, against servers whose ownership you have proven, and reports the results as JSON, SARIF and Markdown.

19 checks, field-tested against a certified OpenID provider: OAuth discovery, refresh token rotation and replay, redirect URI strictness, PKCE enforcement, single-use codes, token audience, Origin validation, tokens in URLs, session IDs used as credentials, CORS, throttling and consent CSRF (in a real browser). It works as a CLI with an interactive login, as an MCP server so an AI assistant can run the audit, and as a GitHub Action. A deliberately vulnerable lab lets you try everything in a minute.

Only test servers you own or are explicitly authorized to test. Active checks change state on the target. The tool enforces an ownership proof before running them, but responsibility stays with the operator.

Field-tested
Why another scanner?
Install
Try it in a minute: the lab
Quick start
Ownership proof
Refresh token checks
Interactive login
Redirect URI checks
Throttling check
Consent CSRF check
Use it from an MCP client
What it checks
Combine with mcp-posture
Reports and exit codes
GitHub Action
Safety of the scanner
Roadmap
Development
Contributing and security

Field-tested

Besides its own test suite and lab, mcp-authprobe was run against real authorization stacks before each release:

node-oidc-provider (an OpenID Certified authorization server) with dynamic registration, resource indicators and JWT access tokens, in front of an MCP server built with the official TypeScript SDK that validates the token audience and the Origin header. Every check that can be judged from outside passed; MAP-THR01 failed, as expected, since that provider leaves rate limiting to the deployment; and its consent page, protected by a per-flow identifier instead of an anti-CSRF field, is reported as inconclusive with the reason.
The MCP TypeScript SDK's OAuth example server, a demonstration that is not meant for production. The results matched its code: redirect_uri not bound to the code, no Origin validation, unsafe redirect URIs accepted at registration, no refresh tokens, and crashes reported as inconclusive rather than passes. Its sessions correctly require the token on every request (MAP-SES01 passes).

These runs led to several fixes: results kept when a server issues no refresh token or crashes during login, a throttling check that copes with a broken refresh grant, and the per-flow identifier analysis above.

Why another scanner?

Good tools already exist, and this one is meant to sit next to them, not replace them:

Tool	Focus	Overlap with mcp-authprobe
mcp-posture	Passive posture of remote servers: OAuth metadata per RFC, transport, tool poisoning, rug pulls	None by design: it never sends state-changing requests. Run it first.
MCPJam OAuth conformance	Runs real OAuth flows and checks conformance, with a few negative checks	Basic redirect URI rejection. No refresh token replay, throttling or consent CSRF.
Cisco mcp-scanner, Snyk agent-scan	Malicious tools, configs, local servers	None.

mcp-authprobe focuses on what only an active, authorized test can confirm, and uses check IDs (MAP-…) that do not clash with mcp-posture's (MCPP-…). mcp-posture reserves its own active IDs for this and points here; the two reports can be merged into one.

Install

Requires Node.js 22.19 or later.

# run without installing

npx mcp-authprobe --help

or install globally

npm install -g mcp-authprobe

Releases are published from GitHub Actions with npm trusted publishing; check the provenance on the package page before installing a security tool.

From source:

git clone https://github.com/Enigmacker/mcp-authprobe.git

cd mcp-authprobe npm ci npm run build node dist/cli.js --help

Try it in a minute: the lab

mcp-authprobe lab starts a small MCP server with its own OAuth authorization server on 127.0.0.1, so you can see every check at work without touching a real server:

# Terminal 1: a deliberately vulnerable server (or --profile secure)

npx mcp-authprobe lab

Terminal 2

npx mcp-authprobe scan http://127.0.0.1:8787/mcp --allow-private npx mcp-authprobe login http://127.0.0.1:8787/mcp --allow-private --out lab-grant.json npx mcp-authprobe scan http://127.0.0.1:8787/mcp --allow-private --credentials-file lab-grant.json

Profile What you should see

vulnerable (default) Refresh token replay accepted, unsafe redirect URIs registered, PKCE not enforced, token audience ignored, foreign Origin accepted, token accepted in the URL, session ID accepted without a token, CORS open to any origin with credentials, no throttling, consent page without CSRF protection. MAP-RDR02 is reported as inconclusive: this server sends unknown visitors to its login page before looking at redirect_uri, which cannot be told apart from outside, and the scanner never turns that into a pass.

secure Every check passes (or is not applicable); MAP-CSR01 runs with consent-check.

The lab only listens on 127.0.0.1 or ::1 (--host, --port, default 8787; names such as localhost are refused so that no resolver can move it elsewhere), keeps everything in memory, and stops with Ctrl-C. Its access tokens are unsigned JWTs, so MAP-AUD01 can read their audience. It is vulnerable on purpose: never expose it.

Quick start

# 1. Create a secret and the proof to publish for your MCP host

mcp-authprobe ownership init mcp.example.com

2. Publish the proof (well-known file or DNS TXT), then keep the secret in your environment

export MCP_AUTHPROBE_SECRET='…'

3. Check the proof is visible

mcp-authprobe ownership verify mcp.example.com

4. Scan

mcp-authprobe scan https://mcp.example.com/mcp --sarif results.sarif --markdown summary.md

5. Log in once with a dedicated test account to create a test grant

mcp-authprobe login https://mcp.example.com/mcp --out ./test-grant.json

6. Full scan, including the refresh token checks

mcp-authprobe scan https://mcp.example.com/mcp --credentials-file ./test-grant.json

Without a valid proof the scan still runs discovery (the same read-only requests any MCP client sends before logging in), and every active check is reported as skipped.

For a local lab on your own machine:

mcp-authprobe scan http://127.0.0.1:8080/mcp --allow-private

Loopback targets with --allow-private do not need a proof.

Ownership proof

Active checks register clients, rotate tokens and send failing requests. To make sure they only ever hit servers whose operator agreed to it, the scanner requires a proof for every host it would contact: the MCP server host and, when it differs, the authorization server host.

The proof is a hash, bound to the host, of a secret that only you hold:

mcp-authprobe-verification=sha256:<hex(sha256("<host>:<secret>"))>

Publish it in one of two places:

Method	Where	Value
Well-known file	`https:// /.well-known/mcp-authprobe.txt`	one line per proof; other lines are ignored
DNS TXT	`_mcp-authprobe.`	the proof string

Design choices:

The secret never leaves your machine. Only its hash is published, so a proof found in the wild cannot be reused by someone else to scan your server.
Proofs are host-bound. A proof for mcp.example.com is useless for any other host.
The secret is read from `MCP_AUTHPROBE_SECRET` or `--secret-file`, never from the command line, so it does not land in shell history or process listings.
Hosted authorization servers. If your authorization server is a third-party service on its own domain, you can only publish a proof if you control that domain (for example a custom domain). Check the provider's penetration testing policy before running active checks against it.

You can remove the proof as soon as you are done testing.

Refresh token checks

MCP clients are usually public clients, so OAuth 2.1 requires their refresh tokens to be rotated, and RFC 9700 recommends revoking the whole token family when an old one is reused. These properties cannot be read from metadata; they have to be exercised.

The checks need a test grant: a client and a refresh token obtained by logging in to your own server with a dedicated test account.

The easy way is mcp-authprobe login (see Interactive login), which writes the file for you. You can also write it by hand, readable only by you (chmod 600):

"client_id": "your-test-client-id", "refresh_token": "the-refresh-token", "client_secret": "only-for-confidential-clients", "token_endpoint_auth_method": "none" }

token_endpoint_auth_method is none (default for public clients), client_secret_post (default when a secret is present) or client_secret_basic.

The scan sends at most three refresh_token requests to the token endpoint found by discovery:

Step	Request	Expected on a compliant server	Check
1	Refresh with the supplied token	New access token and a new refresh token	`MAP-RTK01`
2	Refresh again with the token from step 1's input (already used)	Rejected, typically `invalid_grant`	`MAP-RTK02`
3	Refresh with the newest token (from step 1's output)	Rejected: reuse revoked the whole family	`MAP-RTK03`

Important:

The grant is consumed. On a compliant server, step 3 revokes it. Never use a grant you still need.
If tokens are not rotated, MAP-RTK01 fails and the two replay checks are reported as not applicable.
A throttled or unexpected response is reported as error (inconclusive), never as a pass.
Token values never appear in output or reports; evidence only shows status codes and OAuth error codes.

Interactive login

mcp-authprobe login https://mcp.example.com

Only the beginning is shown; read the rest in the repo

mcp-authprobe

Overview

PopNx MCP’s three pillars

What you can do with it

Install

Before you install

Values you fill in

What it can do

Basic checksi

Maker matches the repo

Still maintained

Has a licence

Endpoint responds

Sign-in with OAuth

No hidden instructions in tool descriptions

Compared with others in Otheri

Common questions

Alternatives

Spec Driven Development

Remote Desktop Commander

Fomu MCP

README from the maker

mcp-authprobe

Contents

Field-tested

Why another scanner?

Install

or install globally

Try it in a minute: the lab

Terminal 2

Quick start

2. Publish the proof (well-known file or DNS TXT), then keep the secret in your environment

3. Check the proof is visible

4. Scan

5. Log in once with a dedicated test account to create a test grant

6. Full scan, including the refresh token checks

Ownership proof

Refresh token checks

Interactive login