Find out what an unauthenticated client sees when it connects — whether your server requires OAuth, and whether it says so in a way clients can act on.
Once the transport is right, the remaining problem is that nobody can see what your server does. MCP Showcase turns the same URL into a live playground with documentation for every tool.
No token needed. The point is to see what happens without one.
And follow the discovery your server advertises, exactly as a client would.
Whether OAuth is required, what is reachable without it, and how the rest of the surface grades.
A server that requires authorization answers an unauthenticated request with 401 and
points at its authorization server metadata. The client discovers the endpoints from there, runs
the flow, and retries with a token. That discovery step is the whole point: it is what makes
connecting a protected server something a client can do automatically, rather than something a
user has to configure by hand.
This page connects to your server with no credentials at all and reports what a client would find.
Both look like "no tools" to a person, and they are completely different to a client. A clear
401 with discovery metadata tells the client what to do next. An empty tool list
tells it the server has no tools — so it stops, and the user sees a server that connected fine
and does nothing. If your server requires authorization, it should say so in the way clients can
act on.
Worth checking deliberately. Tool names alone describe your internals, so a server that lists tools anonymously and only rejects calls is still leaking a map of itself. For a public read-only server that is fine; for anything else the tool list belongs behind the same gate as the calls.
It does not complete an authorization flow — that needs a real user and a real consent screen. It checks what an unauthenticated client sees and how your server signals its requirements. If you use a static bearer token rather than the discovery flow, the auth checker is the page for that.
Once a client can reach your server, the remaining problem is that nobody can tell what it does. A tool list is not a demonstration, and a prospect will not install a client to find out. MCP Showcase points at the same URL and produces a live playground with generated documentation for every tool, so evaluating your server takes a click.