{"$schema":"https://wellknown.network/schemas/agent-record-v1.json","schemaVersion":"1","id":"ag_k6k62kuapp72","handle":"mcp-authscan","url":"https://wellknown.network/agents/mcp-authscan","links":{"self":"https://wellknown.network/agents/mcp-authscan/record.json","html":"https://wellknown.network/agents/mcp-authscan","markdown":"https://wellknown.network/agents/mcp-authscan/record.md","api":"https://wellknown.network/api/v1/agents/mcp-authscan","status":"https://wellknown.network/api/v1/agents/mcp-authscan/status","claim":"https://wellknown.network/agents/mcp-authscan/claim","claimApi":"https://wellknown.network/api/v1/claims","claimDescriptor":"https://wellknown.network/agents/mcp-authscan/claim.json","badge":"https://wellknown.network/agents/mcp-authscan/badge.svg","openapi":"https://wellknown.network/openapi.json","history":"https://wellknown.network/api/v1/agents/mcp-authscan/history","tools":"https://wellknown.network/api/v1/agents/mcp-authscan/tools"},"ard":{"identifier":"urn:air::server:mcp-authscan","type":"application/mcp-server-card+json"},"kind":"mcp_server","declared":{"name":"mcp-authscan","summary":"Security scanner for MCP server deployments","description":"# VATA MCP Security Scanner — Lab Demonstration & Ecosystem Baseline\n\n**Receipts Over Promises**\n\n---\n\n## Overview\n\nVATA (Vulnerability Assessment and Tracking Archive) is an independent AI security research program running a comprehensive audit of the MCP (Model Context Protocol) ecosystem and baseline security analysis of official MCP reference implementations.\n\nThis repository contains:\n1. **mcp_authscan.py** — MCP security scanner for testing OAuth, CORS, authentication, and protocol-level vulnerabilities\n2. **Lab credibility demonstration** — Before/after validation showing the scanner detects vulnerabilities in intentionally vulnerable servers and confirms fixes\n3. **Reference server security analysis** — Official MCP SDK vulnerability baseline documentation\n\n---\n\n## Quick Start\n\n**Install from source (main branch — latest fixes):**\n\n```bash\ngit clone https://github.com/LHMisme420/mcp-authscan.git\ncd mcp-authscan\npip install -e .\n```\n\n**Run live OAuth server assessment:**\n\n```bash\nmcp-authscan https://api.example.com/mcp \\\n  --authorized-by \"Your Name\" \\\n  --auth-basis \"written consent\" \\\n  --contact \"your.email@example.com\"\n```\n\n**Output:**\n- Human-readable security report with PASS/FAIL/OBSERVATION verdicts\n- OAuth endpoint configuration analysis (RFC 9728 → RFC 8414)\n- Probe results summary with evidence strings\n- Deterministic report hash (SHA256, reproducible across runs)\n\n**Exit codes:**\n- `0` — Scan completed. No FAIL verdicts at or above `--fail-on` threshold (default: high).\n- `1` — Scan completed. FAIL verdicts detected at or above `--fail-on` threshold.\n- `2` — Authorization validation failed (refused, fail-closed, no network calls made). Validation runs before reachability check — authorization is checked before the scanner touches the network.\n- `3` — Target unreachable (connection refused or network error).\n- `4` — Target is not a valid MCP server (preflight check failed).\n- `5` — Server not assessable: discovery incomplete, zero verdicts reache…","publisher":null,"homepage":"https://github.com/LHMisme420/mcp-authscan","repository":"https://github.com/LHMisme420/mcp-authscan/blob/main/CHANGELOG.md","version":"1.1.3","license":"MIT","protocols":["mcp"],"tags":["mcp","model-context-protocol","security","scanner","authentication","authorization","appsec","devsecops","sarif"],"pricing":null,"endpoints":[{"url":"pypi:mcp-authscan","type":"package_pypi","auth":null,"probeable":false}],"skills":null,"tools":null,"extra":null,"attribution":{"kind":"pypi","name":"pypi","license":"pypi","repoUrl":"pypi","summary":"pypi","version":"pypi","description":"pypi","homepageUrl":"pypi"}},"derived":{"capabilities":[{"slug":"dev.version-control","name":"Version Control","confidence":1,"provenance":"derived"},{"slug":"security.scanning","name":"Security Scanning","confidence":1,"provenance":"declared"},{"slug":"security.identity","name":"Identity & Access","confidence":1,"provenance":"declared"},{"slug":"code.security-review","name":"Security Review","confidence":0.917,"provenance":"derived"},{"slug":"dev.ci-cd","name":"CI/CD & Deploy","confidence":0.779,"provenance":"derived"}],"categories":["code","dev","security"],"language":"en"},"observed":{"status":"unknown","statusReason":"Distributed as a package to run locally; no network endpoint to check.","lastOkAt":null,"lastProbedAt":null,"statusComputedAt":null,"reliability30d":null,"latestObservations":[],"tools":null,"package":{"name":"mcp-authscan","registry":"pypi","observedAt":"2026-10-24T17:29:16.283Z","publishedAt":"2026-10-23T11:08:41.088284Z","latestVersion":"1.1.3"},"toolSurface":null,"endpointFacts":[]},"verification":{"claimed":false,"claimedAt":null,"proofs":[]},"provenance":{"sources":[{"source":"pypi","key":"mcp-authscan","url":"https://pypi.org/project/mcp-authscan/","firstSeenAt":"2026-10-24T17:28:01.846Z","fetchedAt":"2026-10-24T17:28:01.846Z","normalizedAt":"2026-10-24T17:28:01.846Z"}]},"firstSeenAt":"2026-10-24T17:28:01.846Z","updatedAt":"2026-10-24T17:29:16.283Z"}