Scanner
What a server's metadata says, measured every night
The scanner reads the public authorization metadata an MCP server publishes for every client and judges the 12 requirements of MCP Authorization 2026-07-28 that metadata can answer. Nothing else is sent: no token, no authorization flow, no request to the endpoint itself. Results land in the atlas as observations, by pull request.
- Servers listed
- 39
- Scanned
- 0
- Checks per server
- 12
- Newest scan
- none yet
Run it yourself
The same command runs the nightly job and your terminal:
pnpm scan https://mcp.example.com/mcp # any server, nothing written
pnpm scan notion # a listed server by id
pnpm scan notion --write # append what the nightly rule would
--write appends observations to data/observations/<id>.yamlfollowing the same append rule as the nightly run; open a pull request with the result. See docs/scanner.md.
What it does not check
11 server-side requirements need a request to the endpoint or a reading of the implementation and stay out of a passive scan: for exampleresource_metadata in the 401 challenge, Documented pre-registration path, 403 insufficient_scope for step-up. Their cells come from documentation and manual checks until active probes exist for verified owners.
Opting out
If you run a listed server and do not want it scanned, withdraw it from the atlas; a withdrawn server is never contacted again. The scanner only reads documents a server publishes for every client.