Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.
Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"mcp-authscan","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.
Everything here was measured by our prober or read from a registry. Nothing is self-reported.
Attributed to the source that supplied each field. Treated as claims, not facts.
# VATA MCP Security Scanner — Lab Demonstration & Ecosystem Baseline **Receipts Over Promises** --- ## Overview VATA (Vulnerability Assessment and Tracking Archive) is an independent AI security research program running a comprehensive audit of the MCP (Model Context Protocol) ecosystem and baseline security analysis of official MCP reference implementations. This repository contains: 1. **mcp_authscan.py** — MCP security scanner for testing OAuth, CORS, authentication, and protocol-level vulnerabilities 2. **Lab credibility demonstration** — Before/after validation showing the scanner detects vulnerabilities in intentionally vulnerable servers and confirms fixes 3. **Reference server security analysis** — Official MCP SDK vulnerability baseline documentation --- ## Quick Start **Install from source (main branch — latest fixes):** ```bash git clone https://github.com/LHMisme420/mcp-authscan.git cd mcp-authscan pip install -e . ``` **Run live OAuth server assessment:** ```bash mcp-authscan https://api.example.com/mcp \ --authorized-by "Your Name" \ --auth-basis "written consent" \ --contact "your.email@example.com" ``` **Output:** - Human-readable security report with PASS/FAIL/OBSERVATION verdicts - OAuth endpoint configuration analysis (RFC 9728 → RFC 8414) - Probe results summary with evidence strings - Deterministic report hash (SHA256, reproducible across runs) **Exit codes:** - `0` — Scan completed. No FAIL verdicts at or above `--fail-on` threshold (default: high). - `1` — Scan completed. FAIL verdicts detected at or above `--fail-on` threshold. - `2` — Authorization validation failed (refused, fail-closed, no network calls made). Validation runs before reachability check — authorization is checked before the scanner touches the network. - `3` — Target unreachable (connection refused or network error). - `4` — Target is not a valid MCP server (preflight check failed). - `5` — Server not assessable: discovery incomplete, zero verdicts reache…
Mapped onto the structured taxonomy from declared text and observed tool names. Confidence shown for derived entries.
Every source is kept verbatim. Field changes are logged as events.