Free tool

MCP OAuth Checker

Find out what an unauthenticated client sees when it connects — whether your server requires OAuth, and whether it says so in a way clients can act on.

Works with streamable HTTP and SSE endpoints, for example https://mcp.example.com/mcp
This server needs authentication
Used for this one request and never stored.

Working is not the same as sellable

Once the transport is right, the remaining problem is that nobody can see what your server does. MCP Showcase turns the same URL into a live playground with documentation for every tool.

How it works

link
Paste your server URL

No token needed. The point is to see what happens without one.

play_circle
We connect anonymously

And follow the discovery your server advertises, exactly as a client would.

checklist
See what is exposed

Whether OAuth is required, what is reachable without it, and how the rest of the surface grades.

What OAuth looks like in MCP

A server that requires authorization answers an unauthenticated request with 401 and points at its authorization server metadata. The client discovers the endpoints from there, runs the flow, and retries with a token. That discovery step is the whole point: it is what makes connecting a protected server something a client can do automatically, rather than something a user has to configure by hand.

This page connects to your server with no credentials at all and reports what a client would find.

Returning nothing is not the same as returning 401

Both look like "no tools" to a person, and they are completely different to a client. A clear 401 with discovery metadata tells the client what to do next. An empty tool list tells it the server has no tools — so it stops, and the user sees a server that connected fine and does nothing. If your server requires authorization, it should say so in the way clients can act on.

What is reachable before authorization

Worth checking deliberately. Tool names alone describe your internals, so a server that lists tools anonymously and only rejects calls is still leaking a map of itself. For a public read-only server that is fine; for anything else the tool list belongs behind the same gate as the calls.

What this does not do

It does not complete an authorization flow — that needs a real user and a real consent screen. It checks what an unauthenticated client sees and how your server signals its requirements. If you use a static bearer token rather than the discovery flow, the auth checker is the page for that.

Related tools

The transport is not the hard part

Once a client can reach your server, the remaining problem is that nobody can tell what it does. A tool list is not a demonstration, and a prospect will not install a client to find out. MCP Showcase points at the same URL and produces a live playground with generated documentation for every tool, so evaluating your server takes a click.

Frequently asked questions

A server that requires authorization answers an unauthenticated request with 401 and points at its authorization server metadata. The client discovers the endpoints from there, runs the flow, and retries with a token. The discovery step is what makes it automatic rather than something a user configures.

That is usually correct behaviour if it requires OAuth — the tool list should not be readable before authorization. What matters is whether it returns a clear 401 with discovery metadata, or simply an empty list, which leaves the client with nothing to act on.

Only if the tools do something. For a genuinely public read-only server it is fine. If they write data, spend money or reach internal systems, anyone who finds the URL can enumerate and call them.

No. It checks what an unauthenticated client sees and how your server signals its requirements. Completing an authorization flow needs a real user, which is what connecting the server as a playground does.

That is common and workable for machine-to-machine use, though it puts key rotation on you. The auth checker covers that case; this page is about the discovery-based flow.

More free MCP tools