OAuth 2.1 / RFC 9728 / MCP authorization conformance catalog. Vendor-neutral test cases that the Authplane SDKs (and any third-party MCP auth library) run against to prove protocol compliance.
-
Updated
Aug 31, 2026 - Python
#
rfc9728
Here are 11 public repositories matching this topic...
MCP OAuth2 plugin secures Model Context Protocol (MCP) traffic on AI Gateway using OAuth 2.0 specification for MCP servers
go golang security jwt oauth2 api-gateway mcp authorization kong openid-connect oidc kong-plugin pkce jwks signet rfc7636 ai-gateway model-context-protocol rfc9728 go-pdk
-
Updated
Oct 31, 2026 - Go
OAuth 2.1 for MCP servers in one Cloudflare Worker. RFC 9728 + 8414 + 7591, PKCE, dynamic client registration, consent UI, multi-tenant. Deploy in 5 minutes.
open-source oauth oauth2 authentication mcp auth0 authorization developer-tools pkce ai-agents authorization-server cloudflare-workers cloudflare-d1 model-context-protocol mcp-server mcp-client mcp-tools rfc9728
-
Updated
Jul 5, 2026 - JavaScript
The step where your MCP server's OAuth sign-in breaks: walks the 401, RFC 9728 and RFC 8414 discovery and client registration from outside and says what breaks for claude.ai, Claude Code, ChatGPT, VS Code and Cursor, whose it is, and the fix.
debugging cli oauth oauth2 typescript mcp vscode cursor claude github-action chatgpt dynamic-client-registration model-context-protocol mcp-server claude-code claude-code-plugin rfc9728 rfc8414
-
Updated
Oct 19, 2026 - TypeScript
OAuth 2.0 bearer-token resource server for Rust HTTP services: JWT access-token validation against a JWKS, RFC 9728 protected-resource metadata, RFC 6750 WWW-Authenticate challenges, an optional static API key, and axum integration. Provider-agnostic (Authentik, Authelia, Kanidm) — every difference is config, never a code branch.
rust security middleware oauth jwt oauth2 authentication authorization rustlang oidc web-programming tower resource-server jwks bearer-token rfc6750 axum jwks-uri rfc9728 rfc9068
-
Updated
Oct 26, 2026 - Rust
Tests whether an MCP server refuses the tokens it should: logs in with PKCE, then tries unsigned, foreign-audience and session-replay tokens. Grades against the MCP authorization spec. Pure Python stdlib.
python security oauth oauth2 mcp authorization pkce security-tools conformance-testing model-context-protocol rfc9728
-
Updated
Oct 23, 2026 - Python
Go library implementing RFC 9728 OAuth 2.0 Protected Resource Metadata
-
Updated
Aug 9, 2026 - Go
Fail your CI when an MCP endpoint serves its tool list without a token. Runtime probe and GitHub Action that also checks RFC 9728 OAuth posture and emits an HMAC-signed receipt of what was observed. Single file, stdlib only.
cli security oauth authentication ci mcp appsec security-scanner security-tools devsecops github-actions model-context-protocol mcp-security rfc9728
-
Updated
Sep 11, 2026 - Python
Diagnose OAuth discovery problems on remote MCP servers: the 401 challenge, RFC 9728 protected resource metadata, authorization server metadata, PKCE S256, client registration, token endpoint error format and an optional PKCE login, checked against the MCP 2026-07-28 and 2025-11-25 authorization rules. Read-only CLI, httpx only, pipx or uvx.
python cli oauth oauth2 mcp authorization developer-tools diagnostics openid-connect hacktoberfest pkce security-tools model-context-protocol mcp-server claude-code rfc9728 rfc8707 rfc8414
-
Updated
Oct 28, 2026 - Python
Evidence for what autonomous software does. Conformance checking and signed, verifiable records of agent actions.
golang security oauth2 mcp ai-agents conformance model-context-protocol agent-infrastructure rfc9728 rfc8707
-
Updated
Aug 9, 2026 - Go
Add this topic to your repo
To associate your repository with the rfc9728 topic, visit your repo's landing page and select "manage topics."