Documentation
¶
Overview ¶
Package authcheck discovers how an MCP server over HTTP is protected (Protected Resource Metadata, authorization server metadata) and checks it against the authorization rules of spec 2026-07-28 and the auth extensions (ext-auth: OAuth client credentials, enterprise-managed authorization).
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Discovery ¶
type Discovery struct {
Challenge string `json:"challenge,omitempty"` // WWW-Authenticate of the 401
MetadataURL string `json:"resourceMetadataUrl"`
Resource string `json:"resource"`
AuthServers []string `json:"authorizationServers"`
ASMetadataURL string `json:"authServerMetadataUrl,omitempty"`
// contains filtered or unexported fields
}
Discovery is what a client learns before authorizing.
func Discover ¶
Discover finds the Protected Resource Metadata (from the 401 challenge, else the well-known URIs) and the first authorization server's metadata. It returns nil, nil if the endpoint does not require authorization.
func (*Discovery) AuthServer ¶
AuthServer returns the first advertised authorization server.
type Flow ¶
type Flow struct {
Name string `json:"name"`
Supported bool `json:"supported"`
Detail string `json:"detail,omitempty"`
Flag string `json:"flag,omitempty"` // how mcp-tester uses it
}
Flow is an authorization flow the server offers.
type Report ¶
type Report struct {
Endpoint string `json:"endpoint"`
Protected bool `json:"protected"`
Discovery *Discovery `json:"discovery,omitempty"`
Flows []Flow `json:"flows,omitempty"`
Results []Result `json:"results"`
AuthServer map[string]any `json:"authServerMetadata,omitempty"`
ResourceMeta map[string]any `json:"resourceMetadata,omitempty"`
}
Report is the outcome of a check run.
Source Files