MCP server · Discovery
resource_metadata in the 401 challenge
An unauthenticated request receives a 401 whose WWW-Authenticate header carries a resource_metadata parameter pointing at the PRM document.
mcp.prm.www-authenticate
In revision 2026-07-28
- Level
- MUST One of two discovery mechanisms the server must offer.
- Defined in
- Authorization Server Discovery › Protected Resource Metadata Discovery RequirementsMCP Authorization 2026-07-28
- Party
- MCP server
- Observable
activeOnly observable by sending requests to the server; recorded by hand or by a future active scanner, never by this site.
Level by revision
| Revision | Level | Section |
|---|---|---|
| 2026-07-28current | MUST One of two discovery mechanisms the server must offer. | Authorization Server Discovery › Protected Resource Metadata Discovery Requirements |
| 2025-11-25 | MUST One of two discovery mechanisms the server must offer. | Authorization Server Discovery › Protected Resource Metadata Discovery Requirements |
Adoption across listed servers
- Supported0
- Partial0
- Unsupported0
- Unknown34
- Not applicable5