DEV Community: X1Y1

We Checked 61 Official MCP Servers Against the Auth Spec

X1Y1 — Tue, 03 Nov 2026 23:35:04 +0000

Most SaaS companies now ship an official remote MCP server, and most of them sit behind OAuth. We wanted to know how closely those servers follow the current MCP authorization spec (the 2026-07-28 revision), so we checked the official servers of 67 vendors from the outside. 61 of them require a login. This post is about those 61.

The short version: the basics are done everywhere. The newer parts of the spec are not.

How we checked

We used our free MCP Server Check. It is passive. For each server it sends one unauthenticated initialize request, reads the public OAuth discovery documents, and calls tools/list only if the server answers without a token. It never calls a tool and never sends a token.

We ran every server on October 26 and again on November 4, 2026. The numbers below are from November 4. Results are point in time and checked from Cloudflare's network, so a server can look different from another network or a few days later.

What every server gets right

All 61 answer an anonymous request with HTTP 401, and all 61 advertise PKCE with S256. That is the part of the spec that stops the most obvious mistakes, and nobody skipped it.

56 of 61 also publish OAuth Protected Resource Metadata (RFC 9728) and point to it from the 401 response, which is how a client finds where to log in. The other 5 either use the older 2025-03-26 discovery layout or publish the metadata without pointing to it in the 401.

Where most of them fall behind

Client registration. The current spec says Dynamic Client Registration "is deprecated and retained for backwards compatibility with authorization servers that do not support Client ID Metadata Documents." 25 of 61 advertise Client ID Metadata Documents (CIMD). The other 36 rely on dynamic registration or manual client setup. Nothing breaks today, but every client that connects to those 36 still needs a registration step the spec is moving away from.

Issuer check. The spec says authorization servers SHOULD include the iss parameter in authorization responses (RFC 9207), and advertise it with authorization_response_iss_parameter_supported. It lets a client catch an OAuth mix-up attack, where a code from one authorization server is sent to another. 40 of 61 do not advertise it.

Scope hint. 22 of 61 give the client no hint about which scopes to request, neither in the 401 nor in scopes_supported. The client then has to guess, and guessing usually means asking for more than it needs.

Who moved in nine days

Between October 26 and November 4, six changes showed up:

Apollo, Cal.com and Neon started advertising Client ID Metadata Documents.
Neon and Mercado Pago started advertising the RFC 9207 issuer parameter.
Datadog's 401 now points to its protected resource metadata.

None of these companies told us about it, and we did not contact them. It is a sign the spec changes are being picked up, just not all at once.

The full table

Score is out of 100 and also includes transport and HSTS checks that are not shown as columns. "Discovery: partial" means the server uses the older discovery layout or does not point to its metadata from the 401.

Company	Score	CIMD	iss (RFC 9207)	Scope hint	Discovery
Fireflies	100	yes	yes	yes	ok
Notion	100	yes	yes	yes	ok
Airtable	98	yes	no	yes	ok
Apollo	98	yes	no	yes	ok
Canva	98	yes	no	yes	ok
Clerk	98	yes	yes	yes	ok
Klaviyo	98	yes	yes	no	ok
Linear	98	yes	yes	yes	ok
Neon	98	yes	yes	no	ok
Railway	98	yes	yes	yes	ok
Sentry	98	yes	yes	yes	ok
Tavily	98	yes	yes	yes	ok
Vercel	98	yes	no	yes	ok
monday.com	98	yes	yes	no	ok
Amplitude	96	yes	no	yes	ok
Cal.com	96	yes	no	no	ok
Grafana	96	yes	no	yes	ok
Granola	96	yes	no	yes	ok
Honeycomb	96	yes	no	yes	ok
MongoDB	96	yes	yes	no	ok
PostHog	96	yes	no	yes	ok
Resend	96	yes	yes	no	ok
Todoist	96	yes	no	yes	ok
Figma	95	no	yes	yes	ok
GitHub	95	no	yes	yes	ok
Supabase	95	no	yes	yes	ok
Semgrep	94	yes	no	no	ok
Asana	93	no	no	yes	ok
Buffer	93	no	no	yes	ok
ClickUp	93	no	yes	yes	ok
Close	93	no	no	yes	ok
Gamma	93	no	yes	yes	ok
GitLab	93	no	no	yes	ok
Jam	93	no	no	yes	ok
Miro	93	no	no	yes	ok
Netlify	93	no	no	yes	ok
Slack	93	no	no	yes	ok
Stripe	93	no	no	yes	ok
Ahrefs	91	no	no	no	ok
Box	91	no	no	no	ok
Cloudflare Bindings	91	no	yes	no	ok
Datadog	91	no	no	no	ok
Dropbox	91	no	no	yes	ok
Hex	91	no	no	no	ok
HubSpot	91	no	no	no	ok
Intercom	91	no	no	yes	ok
Mux	91	no	no	no	ok
PagerDuty	91	no	no	yes	ok
Postman	91	no	no	no	ok
Prisma	91	no	no	yes	ok
Wix	91	no	no	yes	ok
Make	90	no	no	no	ok
PayPal	90	no	no	no	ok
Render	90	no	no	no	ok
Square	90	no	no	no	ok
Webflow	90	no	no	no	ok
Apify	89	yes	yes	yes	partial
Mercado Pago	84	no	yes	yes	partial
Zapier	84	no	no	yes	partial
Plaid	82	no	yes	no	partial
Atlassian	80	no	no	no	partial

Notion and Fireflies passed every check.

Six more vendors answered tools/list without a token: Hugging Face, Context7, Shopify (setup.shopify.com), DeepWiki, Firecrawl and Browserbase. They are documentation, search and scraping tools where open access looks like a deliberate choice, so we left them out of the auth numbers. Nine addresses we tried did not answer as MCP servers, usually because we guessed the wrong URL, and they are not reported.

If you run one of these servers

The three changes are small. Advertise client_id_metadata_document_supported once your authorization server supports CIMD, include iss in authorization responses and set authorization_response_iss_parameter_supported: true, and put a scope in the WWW-Authenticate header of the 401.

If you think we scored your server wrong, run it through the checker and tell us at hello@x1y1.co. We would rather fix a rule than publish a wrong number. There is also a JSON API: https://x1y1.co/api/mcp-check?url=<server>.

Originally published at x1y1.co.

620,000 Downloads Last Week for MCP Servers That Will Never Be Patched

X1Y1 — Tue, 03 Nov 2026 16:02:06 +0000

On November 2, Glow Security published research it calls MCPhantom: AI coding agents keep installing MCP servers that were archived more than a year ago. In 98% of the sessions where an agent set up one of these deprecated servers, the user had not asked for it by name. The agent filled in the package from what its model remembered. Help Net Security covered it on November 3.

We wanted to know if this is still happening at scale, so we checked npm ourselves.

The numbers from npm

These are the twelve packages Glow lists, all under @modelcontextprotocol, with downloads for the week of October 27 to November 2, 2026, from the public npm downloads API. Every one of them is marked deprecated in the npm registry today.

Package	Downloads last week
server-github	200,397
server-slack	176,607
server-postgres	158,147
server-brave-search	31,665
server-puppeteer	30,673
server-google-maps	7,442
server-gdrive	6,049
server-gitlab	5,398
server-redis	3,964
server-aws-kb-retrieval	189
create-server	173
server-everart	134
Total	620,838

npm download counts include CI runs and mirrors, so this is not 620,838 developers. It does show that the deprecation flag is not stopping anyone. npx -y prints a warning and installs the package anyway, and an agent running that command in a terminal has no reason to stop on a warning.

What is wrong with them

Glow reported four high-severity flaws across these servers. The worst is in server-puppeteer: a prompt injection on a page the agent visits can make it start any process on the machine instead of the browser. The developer approved web browsing, and that one approval covers everything after it.

The maintainers closed the report as out of scope because the servers live in the archived repository and are unmaintained. There are no CVEs, so dependency scanners that work from CVE feeds will not flag them. Glow says it has not seen anyone exploit these flaws. We are not claiming otherwise.

Find them in your configs

This lists every deprecated reference server in the usual MCP config files for Claude Code, Cursor, VS Code, Codex CLI and Claude Desktop on a Mac. Run it in each repo root, since project configs live there.

grep -HnoE '@modelcontextprotocol/(server-(github|gitlab|postgres|slack|puppeteer|brave-search|google-maps|gdrive|redis|aws-kb-retrieval|everart)|create-server)' \
  .mcp.json .cursor/mcp.json .vscode/mcp.json \
  ~/.claude.json ~/.cursor/mcp.json ~/.codex/config.toml \
  "$HOME/Library/Application Support/Claude/claude_desktop_config.json" 2>/dev/null

No output means none of those files reference them. Some servers from the same repository are still maintained, such as server-filesystem and server-memory, which is why the pattern names packages one by one instead of matching the whole scope.

What we would run instead

Move to the server the service owner maintains, where one exists:

GitHub: github/github-mcp-server, maintained by GitHub.
Browser automation: microsoft/playwright-mcp (@playwright/mcp), in place of the Puppeteer server.
Brave Search: brave/brave-search-mcp-server (@brave/brave-search-mcp-server).

For Slack, Postgres and the rest, check whether the vendor ships its own server before picking a community one, and read its tool list before you approve it.

Stop the agent from adding them again

Swapping today's configs is not enough if the agent adds the old package back next week. Two things we would set up:

Write the approved list down where the agent reads it. One line in CLAUDE.md or AGENTS.md, such as "Use only these MCP servers: ...", changes what the agent proposes. It is a suggestion to the model, not a control.
Block the install itself. A pre-tool hook (Claude Code supports PreToolUse hooks on Bash) can reject any command that mentions one of these package names. That works whatever the model remembers.

Glow's own advice adds a third: put npm deprecation status into whatever approves a new MCP server. A lookup before install helps, but Glow's researcher also notes it is not enough on its own, which is why we would still keep the hook.

If you run a remote MCP server and want to see what a client sees before it connects, our free MCP Server Check looks at auth, OAuth discovery and tool descriptions from the outside without calling any tool.

Originally published at x1y1.co.